fix: SSE body cap parity, remove dead MCPGraph, tool-search docs - #9
Merged
Conversation
buildSSEServer now routes the SSE handler through an http.Server wrapped in the same middleware as the streamable HTTP transport: httpTokenHandler (auth + body cap) on the WithHTTPToken path, capBodyHandler (body cap) on the bearer-only and no-auth paths. Previously only the token path of ServeSSE capped the body, and ServeSSEWithShutdown skipped the token gate entirely, contradicting the parity the file's header comment claims. Wiring via mcpserver.WithHTTPServer keeps SSEServer.Start/Shutdown managing the wrapped server, so the shutdown contract is unchanged.
graph.go (MCPNode/MCPEdge/MCPGraph/NewMCPGraph) has zero references outside its own test — verified by grep across mcpkit, yaad, sight, inspect, eyrie, tok, trace, hawk-core-contracts, and hawk itself. Consumers project their own graph shapes; AddGraphResource and GraphMIMEType in mcpkit.go stay (they are referenced).
Remove the 'var _ = fmt.Sprintf' import-keeper in vault.go, and rewrite the file's package comment to describe what the vault actually does: a strictly in-memory store with no persistent backing and no zeroization of secret values on Delete. The previous wording implied an OS-keychain/encrypted-file backing that does not exist.
Search iterates an internal map, so result order was nondeterministic; sort by tool name in both the empty-query and term-query branches and pin the behavior with TestToolSearchIndexSearch_SortedOrder. Also add loud doc comments on IndexTool (index- and Server-level) and SearchTools: the index is NOT kept in sync with AddTool and nothing indexes automatically, so callers must index each tool explicitly.
- transport_sse.go: omit redundant type in handler declaration (ST1023) - go.mod + CI: Go 1.26.6 — 1.26.5 stdlib has reachable vulns (GO-2026-6090, GO-2026-6089) that fail govulncheck
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MCPGraph/MCPNode/MCPEdgetypes deleted (zero importers outside graph.go).Search()results now sorted by name.