[mcp-2026] Remove JSON-RPC sidecar; one /mcp owner (official mcp 2.x) #22

Activity

1. manish-wekan

   added

   bugSomething isn't workingSomething isn't working

   on Sep 9, 2026
2. manish-wekan commented on Oct 27, 2026

   

   manish-wekan

   on Oct 27, 2026

   Last edited by manish-wekan

   CollaboratorAuthor

   More actions

   Interaction with the transform pipeline (PR #88, issues #61 / #62)

   PR #88 adds the transform pipeline (#61) and progressive discovery (#62). It hooks into the tools/list and tools/call handlers on the low-level server, not the sidecar, so removing the sidecar does not bypass it. The pipeline does need a request context that this issue now owns, so this issue should add the items below.

   Verified

   Checked on PR #88 head 69e316a, alone and with PR #34 merged on top. To merge #34 I resolved the dispatch.py / middleware.py modify/delete conflicts by keeping the deletion.

   Check (HTTP POST /mcp via get_combined_app())	#88	#88 + #34
   tools/list returns only search_tools, call_tool (auto, modern, legacy)	yes	yes
   search_tools → call_tool runs the real tool	yes	yes
   call_tool on a @use_guards tool is denied	yes	yes
   ping on auto / modern	result: {} (sidecar)	−32601
   request_ctx set while a transform runs in tools/list	no	no
   TransformContext.session_id / .execution_context populated	no (always None)	no
   Mcp-Session-Id visible to transforms on legacy	only inside tools/call	only inside tools/call
   Full suite	855 passed	614 passed, 1 failed, 4 collection errors (all sidecar test modules, see #27)

   So the merge order of #88 and #34 is not blocked by behaviour. The gap is the request context the pipeline receives.

   What this issue should add

   1. Set request_ctx for every handler, in one place.
   _list_tools (nitrostack/core/app.py:905 on #88) never calls request_ctx.set(ctx). Only tools/call, resources/read, prompts/get and the task handlers do it (app.py:933, 966, 991, 1781–1855), each in its own copy. With the sidecar gone, the official ServerRequestContext is the only source of request data. Set the contextvar once, around every request handler (tools/list, resources/list, prompts/list included), for example in NitroStackMcpServer's dispatch, rather than adding another per-handler copy.

   2. Define the caller identity on sessionless eras and expose it through one helper.
   After this issue, auto and modern never carry Mcp-Session-Id. A request-scoped key therefore has to be:

   • the Mcp-Session-Id on legacy;
   • the verified token subject (_auth_metadata_from_request_ctx) on auto and modern;
   • otherwise None, documented as such.

   Expose this as one function, for example caller_identity(request_ctx) -> (session_id, subject), and use it for both TransformContext and task ownership (#25). That keeps "unsigned userId is not identity" in a single place. Per-session tool visibility depends on this decision.

   3. Build TransformContext from the request.
   TransformContext() at app.py:916 and TransformContext(_invoker=...) at app.py:1297 leave session_id and execution_context empty. Populate both from item 2 in the tools/list and tools/call handlers. The field names already exist in nitrostack/transforms/transform.py:48-49; only the wiring is missing. If #88 merges first, this is a small follow-up in this issue. If this issue merges first, #88 picks it up on rebase.

   4. Add HTTP-level transform tests to this issue's test file.
   The #88 tests call request_handlers in-process, so they would still pass if a future ASGI layer answered tools/list itself. In tests/test_mcp22_official_http_owner.py, add a TestClient(get_combined_app()) test with transforms=[RegexSearchTransform()] covering:

   • tools/list returns only the meta-tools;
   • search_tools then call_tool returns the real result;
   • call_tool on a guarded tool is denied;
   • a spy transform sees non-None request_ctx in both hooks, and the expected identity per era.

   This proves "one /mcp owner" for the pipeline, not only for ping.

   5. Rebase #34 on current develop.
   #34 still conflicts on nitrostack/transports/dispatch.py and middleware.py (modify/delete). Keep the deletion. The 4 collection errors (test_mcp20_blueprint.py, test_mcp20_deprecated.py, test_mcp20_jsonrpc_wire.py, test_mcp20_stateless_http.py) and the test_mcp20_acceptance.py::...test_mcp20_test_modules_importable failure are the expected sidecar test breakage for #27. List them in the PR so reviewers can tell them apart from real regressions.

   Out of scope here (noted for the owners of those issues)

   • _invoke_for_transform (app.py:1217) drops task, so a task-augmented call_tool runs synchronously. This belongs to [mcp-2026] Hide tasks on 2026 wire until tasks/update exists #25.
   • With progressive discovery, Mcp-Name is call_tool and the real target is only in arguments.name. A gateway that authorizes by Mcp-Name cannot see the target. Record the decision under [mcp-2026] Align 2026 wire: drop ping, add -32021, discover _meta, MUST headers #24 / Refresh #24 (MCP 2026 wire alignment): body is partly outdated and has no implementation #78.
   • On [transforms] Progressive tool discovery (#62) #88 itself: the requested guard test was not added (from nitrostack import use_guards is imported but unused in tests/test_transforms_search_app.py). app.py imports nitrostack.transforms twice. pytest-asyncio is added as a dev dependency, although [health] Async @health_check methods always report an error #63 #89 deliberately avoided needing it.

   Acceptance additions

   • request_ctx is set for every request handler from a single place
   • One caller_identity helper, documented per era, used by transforms and task access
   • TransformContext.session_id / execution_context populated in tools/list and tools/call
   • HTTP-level transform tests in tests/test_mcp22_official_http_owner.py
   • [mcp-2026] Remove JSON-RPC sidecar; one /mcp owner #34 rebased on develop; remaining failures are only the sidecar modules listed above
3. manish-wekan

   closed this as completedon Oct 28, 2026