Skip to content

mcp: close HTTP response body from DELETE request in streamableClientConn.Close#929

Merged
guglielmo-san merged 1 commit into
modelcontextprotocol:mainfrom
blackwell-systems:fix/close-delete-response-body
May 4, 2026
Merged

mcp: close HTTP response body from DELETE request in streamableClientConn.Close#929
guglielmo-san merged 1 commit into
modelcontextprotocol:mainfrom
blackwell-systems:fix/close-delete-response-body

Conversation

@blackwell-systems
Copy link
Copy Markdown
Contributor

Summary

The DELETE request that terminates a streamable HTTP session discards the *http.Response without closing its body. Per the net/http documentation, this prevents the underlying TCP connection from being reused and leaks it.

The bug

// mcp/streamable.go:2239 (before)
} else if _, err := c.client.Do(req); err != nil {
    c.closeErr = err
}

On the success path (no error), the response is silently discarded. The default client is http.DefaultClient with keep-alives enabled, so the leaked connection stays open until GC or process exit.

The fix

// mcp/streamable.go:2239 (after)
} else if resp, err := c.client.Do(req); err != nil {
    c.closeErr = err
} else {
    resp.Body.Close()
}

All 10 other client.Do call sites in this file close the response body. This one was missed.

Test plan

  • go build ./... passes
  • go test ./... -short passes

Fixes #928

…Conn.Close

The DELETE request that terminates the session discards the response
without closing its body. This leaks the underlying TCP connection on
every normal session close, since the default transport has keep-alives
enabled and net/http requires Body.Close for connection reuse.

All other client.Do call sites in this file (10 of them) close the
response body. This one was missed.

Fixes modelcontextprotocol#928
@guglielmo-san guglielmo-san merged commit 8e45782 into modelcontextprotocol:main May 4, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

streamableClientConn.Close leaks HTTP response body from DELETE request

2 participants