WebMvcSseServerTransportProvider causes Tomcat worker thread to hang

[SightStudio]

Bug description

I'm using this SDK as a remote MCP server with Spring AI

When using WebMvcSseServerTransportProvider under a Spring MVC (Tomcat) environment,
The request thread hangs indefinitely if the downstream publisher does not emit a value.

This happens because .block() is called inside the request-handling flow,
causing the Servlet container's worker thread (e.g., http-nio-8080-exec-*) to block.

If the downstream publisher fails to emit, the thread is never released, leading to thread exhaustion under load.

Environment

• java-sdk: v0.10.0
• Java version: 21
• Server: Tomcat (Spring Web MVC)
• Remote MCP (With Oauth)

Steps to reproduce

1. Run Java SDK with WebMvcSseServerTransportProvider
2. Within the tool, return a Mono.never() or any publisher that never emits
3. Call the tool via a standard /mcp/message call
4. Observe that the request hangs, and the Tomcat worker thread never completes

As a result, the longer the remote MCP runs, the more worker threads end up hanging.

Additionally, due to this issue, it is currently not possible to scale out the server.

Here's the log I got from the remote MCP server.

Expected behavior

The MCP server should not call .block() on the request-handling thread.

Either:

• The response should be handled in a non-blocking way using WebClient or Project Reactor fully,
• or if blocking is absolutely necessary, it should be scheduled on a separate thread via Schedulers.boundedElastic() to avoid blocking the Tomcat worker thread.

Minimal Complete Reproducible example

[SightStudio]

For now, I've created a custom implementation that adds a timeout to the blocking call

so that threads no longer hang indefinitely.
However, this is only a temporary workaround.
Switching to WebFlux just for this would be too costly.

public class MyWebMvcSseServerTransportProvider implements McpServerTransportProvider {
   // ...

  private ServerResponse handleMessage(ServerRequest request) {
          if (this.isClosing) {
              return ServerResponse.status(HttpStatus.SERVICE_UNAVAILABLE).body("Server is shutting down");
          }
  
          if (request.param("sessionId").isEmpty()) {
              return ServerResponse.badRequest().body(new McpError("Session ID missing in message endpoint"));
          }
  
          String sessionId = request.param("sessionId").get();
          McpServerSession session = sessions.get(sessionId);
  
          if (session == null) {
              return ServerResponse.status(HttpStatus.NOT_FOUND).body(new McpError("Session not found: " + sessionId));
          }
  
          try {
              String body = request.body(String.class);
              McpSchema.JSONRPCMessage message = McpSchema.deserializeJsonRpcMessage(objectMapper, body);
  
              // Process the message through the session's handle method
              session.handle(message).block(Duration.ofSeconds(5)); // here
  
              return ServerResponse.ok().build();
          } catch (IllegalArgumentException | IOException e) {
              logger.error("Failed to deserialize message: {}", e.getMessage());
              return ServerResponse.badRequest().body(new McpError("Invalid message format"));
          } catch (Exception e) {
              logger.error("Error handling message: {}", e.getMessage());
              return ServerResponse.status(HttpStatus.INTERNAL_SERVER_ERROR).body(new McpError(e.getMessage()));
          }
      }

   // ...
}