stacklok / toolhive / 36301321469

71%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

MCP policy middleware skipped requests that the shared parser did not read, while the transports could still execute their JSON-RPC bodies. Validate complete messages independently of Content-Type before policy evaluation and forwarding.

Preserve transport-owned responses, exact request IDs, and legacy SSE session ownership. Normalize leading BOMs before webhook processing so parsing and policy evaluation inspect the same body.

Add regression coverage for direct proxies and vMCP, including webhook enforcement, rate-limit accounting, malformed messages, and response forwarding. Keep the unrelated compatibility-client shutdown deadlock outside this advisory fix.

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>

Coverage Stats

150 of 159 new or added lines in 8 files covered. (94.34%)

19 existing lines in 6 files now uncovered.

84673 of 119337 relevant lines covered (70.95%)

125.64 hits per line