Repository navigation
MCP 2026-07-28 HTTP: cancelling a tool call leaves the original request stream open #4190
Description
Summary
Canceling a modern HTTP tool can leave server work and the original stream alive after the caller thinks it ended.
Evidence (senpi main at the audit, 2026-10-24)
- X2 (divergent, high): Canceling a modern HTTP tool can leave server work and the original stream alive after the caller thinks it ended.
- Evidence:
packages/coding-agent/src/core/extensions/builtin/mcp/modern/transport.ts:27-28,41-45,78-83,109-157;@modelcontextprotocol/sdk 1.32.1 dist/esm/shared/protocol.js:698-714sends a separate notification, not stream close - Spec:
spec 2026-07-28 docs/specification/2026-07-28/basic/patterns/cancellation.mdx“Transport-Specific Cancellation”, “Timeouts”;spec 2026-07-28 docs/specification/2026-07-28/basic/transports/streamable-http.mdx“Cancellation”
- Evidence:
Expected
Cancelling a request on a 2026-07-28 Streamable HTTP connection closes that request's response stream as the transport section requires, in addition to any cancellation notification.
Acceptance
- A RED test that fails on current main first, then the fix.
- Legacy (2025-11-25 and earlier) servers behave as today.
Related
Follow-up of #3304 / #3309 from the MCP 2026-07-28 spec-sync audit. Headless elicitation: #4185.
Activity
code-yeongyu commentedon Oct 25, 2026
Fixed on main by #4207 (merged as 7d73f35).
Evidence: a real HTTP/SSE reproduction through the modern request adapter, run on unchanged main, passes:
Per the 2026-07-28 streamable HTTP rules, closing the request stream is the cancellation signal for modern HTTP, so no separate cancellation POST is sent. Legacy (pre-2026-07-28) behaviour is unchanged by #4207.