Function createHttpServer

src/server.ts:29–207

(
  mcpServer: MCPServer,
  port = DEFAULT_PORT,
  useHttps = false,
  certPath?: string,
  keyPath?: string,
)

 * @returns Object containing the express app, http server
 */
export function createHttpServer(
  mcpServer: MCPServer,
  port = DEFAULT_PORT,
  useHttps = false,
  certPath?: string,
  keyPath?: string,
): {
  app: ReturnType<typeof express>;
  httpServer: http.Server | https.Server;
} {
  // Create the Express app
  const app = express();

  // Create server based on protocol
  let httpServer: http.Server | https.Server;

  if (useHttps) {
    if (!certPath || !keyPath) {
      throw new Error('Certificate and key paths are required for HTTPS');
    }

    // Validate certificate files exist
    if (!fs.existsSync(certPath)) {
      throw new Error(`Certificate file not found: ${certPath}`);
    }
    if (!fs.existsSync(keyPath)) {
      throw new Error(`Key file not found: ${keyPath}`);
    }

    try {
      const httpsOptions = {
        cert: fs.readFileSync(certPath),
        key: fs.readFileSync(keyPath),
        // Security options
        minVersion: 'TLSv1.2' as const,
      };
      // eslint-disable-next-line @typescript-eslint/no-misused-promises
      httpServer = https.createServer(httpsOptions, app);
    } catch (error) {
      throw new Error(
        `Failed to load TLS certificates: ${error instanceof Error ? error.message : String(error)}`,
      );
    }
  } else {
    // eslint-disable-next-line @typescript-eslint/no-misused-promises
    httpServer = http.createServer(app);
  }

  // Track active transports by session ID
  const transports: Record<string, SSEServerTransport> = {};
  const endpoint = '/mcp';

  // Client limit enforcement middleware
  app.use(endpoint, (req, res, next) => {
    if (req.method === 'GET' && Object.keys(transports).length >= MAX_SSE_CLIENTS) {
      res.status(503).json({
        success: false,
        message: `Maximum number of SSE clients (${MAX_SSE_CLIENTS}) reached`,