Skip to content

Conversation

@greedy52
Copy link
Contributor

@greedy52 greedy52 commented Jan 8, 2026

fixes #62334

changelog: fix an issuse MCP Session Listen events may spam audit log with service error malformed line in SSE stream: ""

there is a bug in the current SSE event reader. this change replace it with the latest code from the official go-sdk:
https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/event.go
(unfortunately we cannot call the function directly atm)

besides copying some tests from the SDK, all existing tests also passed. and manually tested that the bug no longer happens.

@greedy52 greedy52 self-assigned this Jan 8, 2026
@greedy52 greedy52 added MCP MCP Server related backport/branch/v18 labels Jan 8, 2026
@greedy52 greedy52 changed the title [mcp] replace SSE event parse with logic from official go-sdk [mcp] replace SSE event parser with logic from official go-sdk Jan 8, 2026

// empty reports whether the Event is empty.
func (e event) empty() bool {
return e.name == "" && e.id == "" && len(e.data) == 0 && e.retry == ""
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So close to return e == event{}, yet so far. (No action required.)

// https://github.com/modelcontextprotocol/go-sdk/blob/a225d4dc7ded92f5492651a1bc60499b3be27044/mcp/event.go#L44
var b bytes.Buffer
if e.name != "" {
fmt.Fprintf(&b, "event: %s\n", e.name)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Separate write calls would be better. The types are all string or []byte, so there's not even need for strconv and the likes.

		b.WriteString("event : ")
		b.WriteString(e.name)
		b.WriteRune('\n')

OK to push back if you'd rather keep it like the original.

)

// event is an event is a server-sent event.
// Copied from official go-sdk with minor modification (make all fields private):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any chance we could move all the copied code in its owns files, separate from stuff we've written ourselves?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

"MCP Session Listen" spams audit log

4 participants