Unable to Wrap SSE Handler with Middleware Using WithHTTPServer

[dwisiswant0]

i’m wondering if there’s a proper way to wrap an SSE server handler with middleware. i’ve already tried using WithHTTPServer to inject middleware logic, but it doesn’t seem to have any visible effect on the SSE handler, it looks like the middleware might be getting bypassed or not applied at all in this context.

if there’s a recommended approach or example of how to attach middleware to SSE endpoints specifically, that would be super helpful. just trying to figure out the best way to apply things like caching, auth checks, or other pre-processing layers before the SSE stream begins.

[dwisiswant0]

https://modelcontextprotocol.io/docs/concepts/transports#network-security

[ezynda3]

This should be fixed with this PR #229

[dwisiswant0]

thank you, @ezynda3! but it seems like that didn’t resolve my issue. in my case, i’m trying to wrap the SSE server using a custom HTTP framework, e.g. with Fiber, along with a few middlewares. but, it seems to hang when it reaches OnRegisterSession inside the SSE handler.

i’m not sure what exactly is going wrong or even where to start debugging. what’s odd is that when using the plain SSE server without any wrapping, everything works as expected.

// Serve starts the MCP server based on the specified server type.
func Serve(ctx context.Context, opts *types.Options) error {
	switch opts.ServerTransport {
	case "stdio":
		opts.StdioServer = server.NewStdioServer(opts.MCPServer)

		return opts.Listen(ctx, os.Stdin, os.Stdout)
	case "sse":
		sseOptions := []server.SSEOption{
			server.WithSSEEndpoint(opts.SSEEndpoint),
			server.WithMessageEndpoint(opts.MessageEndpoint),
		}
		sseServer := server.NewSSEServer(opts.MCPServer, sseOptions...)
		opts.HTTPServer = getHTTPServer(ctx, opts, sseServer)

		return opts.HTTPServer.Listen(opts.ServerAddress)
	}

	return errors.New("no operation")
}

// getHTTPServer initializes and returns a new HTTP server instance.
// It sets up middleware for request ID generation, key authentication, rate limiting,
// caching, and context management. It also integrates the SSE server for handling
// server-sent events.
func getHTTPServer(ctx context.Context, opts *types.Options, sseServer *server.SSEServer) *fiber.App {
	app := fiber.New(fiber.Config{
		Prefork:               false,
		CaseSensitive:         true,
		DisableStartupMessage: true,
		StrictRouting:         true,
		ServerHeader:          fmt.Sprintf("%s/%s", common.AppName, common.AppVersion),
		AppName:               common.AppName,
		JSONEncoder:           json.Marshal,
		JSONDecoder:           json.Unmarshal,
		ErrorHandler:          errHandler,
		ReduceMemoryUsage:     true,
	})

	app.Use(recover.New())
	app.Use(requestid.New())
	app.Use(cors.New(cors.Config{
		AllowOrigins: "*",
		AllowHeaders: "Cache-Control",
	}))
	app.Use(func(c *fiber.Ctx) error {
		c.SetUserContext(ctx)
		c.Locals("keyauth", opts.KeyAuth)

		return c.Next()
	})
	app.Use(keyauth.New(keyauth.Config{
		Validator:    key.ValidateCtx,
		KeyLookup:    key.KeyLookup,
		AuthScheme:   key.AuthScheme,
		ContextKey:   key.ContextKey,
		ErrorHandler: errHandler,
	}))
	app.Use(cache.New(cache.Config{
		Expiration: 2 * time.Second,
	}))
	app.Use(limiter.New(limiter.Config{
		LimitReached: limiterHandler,
		KeyGenerator: limiterKeyGenerator,
	}))
	app.Use(sseServer.CompleteSsePath(), adaptor.HTTPHandler(sseServer.SSEHandler()))
	app.Use(sseServer.CompleteMessagePath(), func(c *fiber.Ctx) error {
		sessionID := c.Params("sessionId")
		if sessionID != "" {
			c.Locals("sessionId", sessionID)
			c.SetUserContext(context.WithValue(c.UserContext(), "sessionId", sessionID))
		}

		return adaptor.HTTPHandler(sseServer.MessageHandler())(c)
	})

	return app
}

test with mcp-remote:

$ npx -p mcp-remote@latest mcp-remote-client http://localhost:8080/sse --header "Authorization: Bearer sometoken"

[3251186] Using automatically selected callback port: 3333
[3251186] Using custom headers: {"Authorization":" Bearer sometoken"}
[3251186] [3251186] Connecting to remote server: http://localhost:8080/sse
[3251186] Using transport strategy: http-first
[3251186] Received error: Error POSTing to endpoint (HTTP 405): Method not allowed

[3251186] Recursively reconnecting for reason: falling-back-to-alternate-transport
[3251186] [3251186] Connecting to remote server: http://localhost:8080/sse
[3251186] Using transport strategy: sse-only

[cryo-zd]

em, how about calling func sseServer.SSEHandler() by a GET request? From the log Received error: Error POSTing to endpoint (HTTP 405): Method not allowed, it seems that we use a POST request at the first time ?

func (s *SSEServer) handleSSE(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodGet {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}
      //...
}

[dwisiswant0]

@cryo-zd - mcp-remote fallback to sse-only. See the log.

[dwisiswant0]

Here is the log w/o wrapping SSE handler:

// Serve starts the MCP server based on the specified server type.
func Serve(ctx context.Context, opts *types.Options) error {
	switch opts.ServerTransport {
	case "stdio":
		opts.StdioServer = server.NewStdioServer(opts.MCPServer)

		return opts.Listen(ctx, os.Stdin, os.Stdout)
	case "sse":
		sseOptions := []server.SSEOption{
			server.WithSSEEndpoint(opts.SSEEndpoint),
			server.WithMessageEndpoint(opts.MessageEndpoint),
		}
		opts.SSEServer = server.NewSSEServer(opts.MCPServer, sseOptions...)
		return opts.Start(opts.ServerAddress)
		// opts.HTTPServer = getHTTPServer(ctx, opts, sseServer)

		// return opts.HTTPServer.Listen(opts.ServerAddress)
	}

	return errors.New("no operation")
}

$ npx -p mcp-remote@latest mcp-remote-client http://localhost:8080/sse 
[109934] Using automatically selected callback port: 3333
[109934] [109934] Connecting to remote server: http://localhost:8080/sse
[109934] Using transport strategy: http-first
[109934] Received error: Error POSTing to endpoint (HTTP 405): Method not allowed

[109934] Recursively reconnecting for reason: falling-back-to-alternate-transport
[109934] [109934] Connecting to remote server: http://localhost:8080/sse
[109934] Using transport strategy: sse-only
[109934] Connected to remote server using SSEClientTransport
[109934] Connected successfully!
[109934] Requesting tools list...
[109934] Received message: {
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "tools": [
      {
        "annotations": {
          "destructiveHint": true,
          "openWorldHint": true
        },
        "inputSchema": {
# ... SNIPPED ...