Fix safe-outputs MCP server: Enable stateless mode for gateway compatibility

[Copilot]

The safe-outputs MCP HTTP server failed to register tools with error code=-32001, message=Session not found. The server required MCP protocol initialization (session handshake), but the MCP gateway calls methods directly without performing initialization.

Changes

File: actions/setup/js/safe-outputs-mcp-server.cjs

- startHttpServer({ port, logDir }).catch(error => {
+ startHttpServer({ port, logDir, stateless: true }).catch(error => {

Enables stateless mode (no session management) in the HTTP transport. The server now accepts direct method calls like tools/list without requiring prior initialize requests or Mcp-Session-Id headers.

Context

The MCP HTTP transport implementation in mcp_http_transport.cjs has two modes:

• Stateful (default): Requires initialize → generates session ID → validates Mcp-Session-Id header on all subsequent requests
• Stateless: Accepts method calls directly without session management

The MCP gateway uses the stateless pattern, calling methods immediately without the initialization handshake that stateful mode expects.

Original prompt

Reference: https://github.com/githubnext/gh-aw/actions/runs/21232198085/job/61092829424

Review gateway logs and investigate why the safeoutputs server failed to run

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.