Function handleClientRequest

mcp/src/http-server.ts:193–259

(
  req: Request,
  res: Response,
  cache: ResolveCache,
  opts: HttpServerOptions,
)

}

async function handleClientRequest(
  req: Request,
  res: Response,
  cache: ResolveCache,
  opts: HttpServerOptions,
): Promise<void> {
  const bearer = extractBearer(req);
  if (!bearer) {
    res.setHeader("WWW-Authenticate", bearerChallenge(req, opts));
    res.status(401).json(jsonRpcError(req.body, -32001, "missing bearer token"));
    return;
  }

  // Resolve the credential's scope + bound agent. A cache hit skips the
  // backend round-trip; a miss probes `whoami` once and caches the result.
  // A revoked/expired bearer surfaces as 401 here (InvalidBearerError).
  let principal = cache.get(bearer);
  if (!principal) {
    let resolved: { value: ResolvedPrincipal; cacheable: boolean };
    try {
      resolved = await resolvePrincipal(opts, bearer);
    } catch (err) {
      if (err instanceof InvalidBearerError) {
        res.setHeader(
          "WWW-Authenticate",
          `${bearerChallenge(req, opts)}, error="invalid_token"`,
        );
        res.status(401).json(jsonRpcError(req.body, -32001, "invalid bearer token"));
        return;
      }
      throw err;
    }
    principal = resolved.value;
    // Only cache a genuine whoami result. A transient backend failure yields a
    // least-privilege fallback that must NOT stick — re-probe next request so
    // the session self-corrects once the backend recovers.
    if (resolved.cacheable) cache.set(bearer, principal);
  }

  // The cold-path whoami probe above is awaited, so the client may have
  // disconnected meanwhile. If so, `res`'s "close" has already fired — bail
  // before building a transport whose teardown listener would never run.
  if (res.closed) return;

  // Stateless: a fresh server + transport per request, torn down when the
  // response closes. The SDK forbids reusing a stateless transport across
  // requests (message-id collisions), and a fresh transport with
  // sessionIdGenerator=undefined skips all session/initialize gating, so a
  // bare tools/call dispatches without a prior initialize on this instance.
  const client = buildClient(opts, bearer, principal);
  const server = buildServer({ client });
  const transport = new StreamableHTTPServerTransport({
    sessionIdGenerator: undefined,
  });
  res.on("close", () => {
    void transport.close();
    void server.close();
  });