Function makeCloudMcpAgentHandler

apps/cloud/src/mcp/agent-handler.ts:232–396

()

  });

export const makeCloudMcpAgentHandler = () => {
  const serveOptions = {
    binding: "MCP_SESSION",
    transport: "streamable-http",
  } as const;
  // The agents SDK builds an exact-match `URLPattern` from the path handed to
  // `serve` (see `createStreamingHttpHandler` in `agents/dist/mcp/index.js`) —
  // a single `/mcp` handler never matches `/mcp/toolkits/<slug>` and falls
  // through to its own internal 404. A second `serve` mounted on the
  // parameterized path picks it up (`URLPattern` supports `:slug` segments);
  // the auth/ownership/props logic above is unchanged and shared, only the
  // final dispatch target differs.
  const serve = McpSessionDOSqlite.serve("/mcp", serveOptions);
  const serveToolkit = McpSessionDOSqlite.serve("/mcp/toolkits/:slug", serveOptions);

  const ALLOWED_METHODS = new Set(["GET", "POST", "DELETE", "OPTIONS"]);

  return async (request: Request, env: Env, ctx: ExecutionContext): Promise<Response> => {
    if (request.method === "OPTIONS") return corsPreflightResponse();
    // The old envelope (packages/hosts/mcp/src/envelope.ts) answered anything
    // outside GET/POST/DELETE/OPTIONS with a JSON-RPC 405; the agents SDK
    // handler only understands its own transport verbs and falls through to
    // a bare 404. Reject before authenticating so PUT/PATCH/etc never reach
    // the session engine.
    if (!ALLOWED_METHODS.has(request.method)) {
      return jsonRpcResponse(405, -32001, "Method not allowed");
    }
    const sessionId = request.headers.get("mcp-session-id");

    const { auth, outcome } = await runTraced(request, env, authenticate(request));
    if (!Predicate.isTagged(outcome, "Authenticated")) {
      // Destroying a live session on auth grounds requires a POSITIVE
      // determination that access is genuinely gone — only `Forbidden` carries
      // that (valid bearer, org absent/revoked). `Unavailable` (transient WorkOS
      // / JWKS failure) and `Unauthorized` (retry with a fresh token) must leave
      // the session intact, so the condemn path is gated on `Forbidden` alone.
      if (Predicate.isTagged(outcome, "Forbidden") && sessionId) {
        await Effect.runPromise(
          Effect.ignore(
            Effect.tryPromise(() =>
              mcpSessionStub(env.MCP_SESSION, sessionId)._cf_scheduleDestroy(),
            ),
          ),
        );
      }
      return renderAuthError(auth, request, outcome);
    }

    if (!sessionId && request.method === "DELETE") {
      // Matches the old envelope's contract (@modelcontextprotocol/sdk's
      // `WebStandardStreamableHTTPServerTransport.handleDeleteRequest`): 200,
      // not 204 — see e2e/cloud/mcp-protocol.test.ts.
      return new Response(null, {
        status: 200,
        headers: { "access-control-allow-origin": "*" },
      });
    }