You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm limited with how much additional information I can provide. I'm working with my enterprise Open Source team to figure out the proper way to navigate this.
I've created a minimal reproduction environment for this issue. While I wasn't able to trigger the bug with current library versions, I can confirm the vulnerable code pattern exists.
Activity
maxisbey commentedon Oct 7, 2025
Could you please provide a minimal reproducible example code snippet we can run locally to see the issue?
cameronsjo commentedon Nov 2, 2025
Reproduction Attempt & Code Analysis
I've created a minimal reproduction environment for this issue. While I wasn't able to trigger the bug with current library versions, I can confirm the vulnerable code pattern exists.
📦 Reproduction Repository
Repository: https://github.com/cameronsjo/sse-disconnect-repro
Complete setup with:
🔍 Confirming the Vulnerable Code Pattern
The issue exists in
mcp/server/streamable_http.pylines 460-480:The Flow:
EventSourceResponsesendshttp.response.startimmediatelysse_writer()blocks waiting for events from the MCP serversse_stream_writer.send()never called → Nohttp.response.body→ ASGI violation🧪 Test Results
Tested with:
Result: Unable to reproduce - all requests completed correctly.
Why: MCP server responds in <10ms, and
sse-starletteappears to send initial chunks that satisfy ASGI requirements.🔧 Proposed Fix
Even though hard to reproduce, the defensive fix ensures robustness:
💡 When This Could Trigger
🎯 Recommendation
Apply the defensive fix because:
Happy to submit a PR with the fix if helpful!
cameronsjo commentedon Mar 28, 2026
Closing — no longer relevant to my workflow.