Skip to content

fix(everything): scope session resources to their server - #4810

Open
Tiancheng-Xu wants to merge 1 commit into
modelcontextprotocol:mainfrom
Tiancheng-Xu:fix/4808-session-resource-ownership
Open

Tiancheng-Xu wants to merge 1 commit into
modelcontextprotocol:mainfrom
Tiancheng-Xu:fix/4808-session-resource-ownership

Conversation

@Tiancheng-Xu

Copy link
Copy Markdown

Description

Fixes #4808.

Session resource registrations were tracked in a module-level map keyed only by URI. When two independent McpServer instances used the same session-resource URI, registering the second resource removed the first server's registration. The registry is now scoped by McpServer using a WeakMap, while repeated registration of the same URI on one server still replaces the previous registration.

Server Details

  • Server: everything
  • Changes to: session resources

Motivation and Context

Independent server sessions can legitimately generate the same resource name. Their registrations must not evict one another.

How Has This Been Tested?

  • Added a regression test for identical URIs across two independent server instances.
  • Added coverage that same-server re-registration still removes the previous registration.
  • npm test in src/everything: 5 test files, 109 tests passed.
  • npm run build in src/everything passed.

Breaking Changes

None.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)

Checklist

  • I have read the MCP Protocol Documentation
  • My changes follows MCP security best practices
  • I have updated the server's README accordingly
  • I have tested this with an LLM client
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have documented all environment variables and configuration options

Additional context

The change is limited to the ownership of the in-memory registration bookkeeping; URI generation and resource behavior are unchanged.

Copilot AI balanced review requested due to automatic review settings September 15, 2026 14:34

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The change is narrowly scoped to in-memory bookkeeping, aligns with the issue’s expected behavior, and includes targeted regression coverage.

Pull request overview

This PR fixes cross-session eviction of “session-scoped” resources in the everything server by scoping the in-memory registration bookkeeping to each McpServer instance, preventing independent sessions from unregistering each other’s resources when URIs collide.

Changes:

  • Replace the global session resource registry with a WeakMap<McpServer, Map<uri, RegisteredResource>> so re-registration only affects resources on the same server instance.
  • Add regression tests covering (1) identical URIs across two servers not evicting each other and (2) same-server re-registration still replacing the prior registration.
File summaries
File Description
src/everything/resources/session.ts Scope session resource tracking per McpServer using WeakMap, avoiding cross-server eviction while preserving same-server replacement behavior.
src/everything/tests/resources.test.ts Add regression tests for cross-server URI collisions and same-server replacement.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 1
  • Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.


💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment on lines 4 to 8
/**
* Tracks registered session resources by URI to allow updating/removing on re-registration.
* This prevents "Resource already registered" errors when a tool creates a resource
* with the same URI multiple times during a session.
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

everything: session resources evict another session's resource when two sessions use the same file name

2 participants