Skip to content

mcp: close HTTP response body from DELETE request in streamableClientConn.Close#929

Open
blackwell-systems wants to merge 1 commit intomodelcontextprotocol:mainfrom
blackwell-systems:fix/close-delete-response-body
Open

mcp: close HTTP response body from DELETE request in streamableClientConn.Close#929
blackwell-systems wants to merge 1 commit intomodelcontextprotocol:mainfrom
blackwell-systems:fix/close-delete-response-body

Conversation

@blackwell-systems
Copy link
Copy Markdown

Summary

The DELETE request that terminates a streamable HTTP session discards the *http.Response without closing its body. Per the net/http documentation, this prevents the underlying TCP connection from being reused and leaks it.

The bug

// mcp/streamable.go:2239 (before)
} else if _, err := c.client.Do(req); err != nil {
    c.closeErr = err
}

On the success path (no error), the response is silently discarded. The default client is http.DefaultClient with keep-alives enabled, so the leaked connection stays open until GC or process exit.

The fix

// mcp/streamable.go:2239 (after)
} else if resp, err := c.client.Do(req); err != nil {
    c.closeErr = err
} else {
    resp.Body.Close()
}

All 10 other client.Do call sites in this file close the response body. This one was missed.

Test plan

  • go build ./... passes
  • go test ./... -short passes

Fixes #928

…Conn.Close

The DELETE request that terminates the session discards the response
without closing its body. This leaks the underlying TCP connection on
every normal session close, since the default transport has keep-alives
enabled and net/http requires Body.Close for connection reuse.

All other client.Do call sites in this file (10 of them) close the
response body. This one was missed.

Fixes modelcontextprotocol#928
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

streamableClientConn.Close leaks HTTP response body from DELETE request

1 participant