+- **Bounded stateless Streamable HTTP mode:** Set `MCP_HTTP_STATELESS=true` to isolate every `POST /mcp` in a fresh MCP server and transport for serverless or horizontally scaled deployments that cannot preserve process-local sessions. Stateless requests are protected by configurable global and per-client-IP in-flight limits, a request lifetime, authorization and hardened Host/Origin checks before server construction, and bounded cleanup. Stateful sessions remain the default; stateless mode is POST-only and does not preserve cross-request sessions, resumable streams, standalone GET notification streams, or DELETE-based termination. ([#226](https://github.com/ihor-sokoliuk/mcp-searxng/pull/226))
0 commit comments