[ROHIT-JR]

Closes #22

Problem

The SDK had two possible owners for the MCP HTTP endpoint:

1. The official MCP SDK Streamable HTTP server.
2. A separate NitroStack JSON-RPC sidecar containing its own middleware and dispatcher.

Both paths could process requests such as ping, initialize, tools/list, and tools/call. This could produce different protocol responses, session behaviour, headers, and error handling depending on which path handled the request.

The duplicate sidecar also contained its own ping helper and transport exports, which were no longer needed once the official MCP SDK became the owner of the HTTP lifecycle.

Proposed solution

Make the official MCP SDK the only owner of /mcp.

The application should:

• Build the HTTP app through the official MCP SDK.
• Return that app without wrapping it in another JSON-RPC dispatcher.
• Keep only transport middleware that normalises headers.
• Remove duplicate sidecar dispatch and middleware code.
• Preserve the health endpoint and official MCP request behaviour.
• Keep unrelated legacy functionality unchanged.

Implementation details

Modified nitrostack/core/app.py

Removed the wrap_stateless_transport(...) wrapper from get_combined_app().

The method now returns the HTTP app created by build_http_app() directly. A comment explains that the official MCP SDK owns the complete Streamable HTTP request lifecycle and that a second dispatcher must not be introduced.

Deleted nitrostack/transports/middleware.py

This file implemented the duplicate stateless transport wrapper around the official MCP app. It was deleted because the official SDK now owns request validation, dispatch, protocol handling, and response generation.

Deleted nitrostack/transports/dispatch.py

This file implemented the duplicate JSON-RPC sidecar dispatcher and its request interception logic. It was deleted because maintaining a second dispatcher could cause the sidecar and official SDK to disagree.

Modified nitrostack/protocol/jsonrpc.py

Removed the standalone build_ping_response() helper. Ping requests are now handled by the official MCP SDK.

Modified nitrostack/__init__.py

Removed public exports for:

• wrap_stateless_transport
• StatelessIngressPipeline

These symbols belonged to the deleted sidecar implementation.

Modified nitrostack/protocol/__init__.py

Removed the obsolete build_ping_response export.

Modified nitrostack/transports/__init__.py

Removed exports for the deleted sidecar classes and helpers, including:

• DispatchStage
• IngressContext
• StatelessIngressPipeline
• StatelessTransportMiddleware
• wrap_stateless_transport
• is_task_wire_interception

The module now exposes only the remaining official transport helpers.

Modified nitrostack/transports/http.py

Updated the middleware documentation to state that it only normalises transport headers and does not perform JSON-RPC dispatch.

Added tests/test_mcp22_official_http_owner.py

Added focused regression tests proving that:

• The application no longer wraps the official HTTP app with the sidecar.
• Deleted sidecar modules are not present.
• Deleted sidecar symbols do not remain in production code.
• /mcp/health remains available.
• The official MCP server handles ping successfully.
• Stateless ping responses do not contain a default Mcp-Session-Id.
• Unknown methods return the standard JSON-RPC -32601 method-not-found error.

Verification

• pytest -q tests/test_mcp22_official_http_owner.py — 5 tests passed.
• Source scan confirmed that duplicate sidecar symbols are absent from production code.
• Health endpoint verification passed.
• Official MCP ping verification passed.
• Unknown-method JSON-RPC error verification passed.
• git diff --check passed.
• No second JSON-RPC dispatcher was added.
• No live Letivo or external business API request was made.

Result

The /mcp endpoint now has one clear owner: the official MCP SDK Streamable HTTP implementation. This removes conflicting request paths, keeps protocol behaviour consistent, and makes future MCP 2026 changes safer to maintain.

[Shreyavemana]

I tested PR #34 locally.

• The new test file passes all the 5 tests.
• However, running the full test suite fails during test collection because existing tests still import modules and functions removed by this PR:
  • test_mcp20_blueprint.py — missing nitrostack.transports.dispatch
  • test_mcp20_deprecated.py — missing nitrostack.transports.dispatch
  • test_mcp20_jsonrpc_wire.py — missing nitrostack.transports.dispatch
  • test_mcp20_stateless_http.py — cannot import build_ping_response from nitrostack.protocol.jsonrpc

Please update or remove the affected tests as appropriate and rerun the full test suite.

[manish-wekan]

Thanks. Removing the sidecar itself looks right, but merged onto current develop this PR has two regressions on auto/modern.

First, CORS falls back to Access-Control-Allow-Origin: *, so MCP_CORS_ALLOWED_ORIGINS is ignored, and the Mcp-* expose headers are gone. Second, modern now accepts the 2025 initialize handshake, which it should reject.

Please move the existing transports/cors.py policy onto the build_http_app result (or land #36 alongside), and reject initialize on modern in the official handler path.

Also, please don't park the 21 tests as xfail(run=False): port each one, delete the ones #22 intends to drop (header-only ping), or move them to #27, and say which in the description.

Finally, the request-context items from the #22 comment are still open. Please include them here or link a follow-up issue.