[ROHIT-JR]

Closes #22

Problem

The SDK had two possible owners for the MCP HTTP endpoint:

1. The official MCP SDK Streamable HTTP server.
2. A separate NitroStack JSON-RPC sidecar containing its own middleware and dispatcher.

Both paths could process requests such as ping, initialize, tools/list, and tools/call. This could produce different protocol responses, session behaviour, headers, and error handling depending on which path handled the request.

The duplicate sidecar also contained its own ping helper and transport exports, which were no longer needed once the official MCP SDK became the owner of the HTTP lifecycle.

Proposed solution

Make the official MCP SDK the only owner of /mcp.

The application should:

• Build the HTTP app through the official MCP SDK.
• Return that app without wrapping it in another JSON-RPC dispatcher.
• Keep only transport middleware that normalises headers.
• Remove duplicate sidecar dispatch and middleware code.
• Preserve the health endpoint and official MCP request behaviour.
• Keep unrelated legacy functionality unchanged.

Implementation details

Modified nitrostack/core/app.py

Removed the wrap_stateless_transport(...) wrapper from get_combined_app().

The method now returns the HTTP app created by build_http_app() directly. A comment explains that the official MCP SDK owns the complete Streamable HTTP request lifecycle and that a second dispatcher must not be introduced.

Deleted nitrostack/transports/middleware.py

This file implemented the duplicate stateless transport wrapper around the official MCP app. It was deleted because the official SDK now owns request validation, dispatch, protocol handling, and response generation.

Deleted nitrostack/transports/dispatch.py

This file implemented the duplicate JSON-RPC sidecar dispatcher and its request interception logic. It was deleted because maintaining a second dispatcher could cause the sidecar and official SDK to disagree.

Modified nitrostack/protocol/jsonrpc.py

Removed the standalone build_ping_response() helper. Ping requests are now handled by the official MCP SDK.

Modified nitrostack/__init__.py

Removed public exports for:

• wrap_stateless_transport
• StatelessIngressPipeline

These symbols belonged to the deleted sidecar implementation.

Modified nitrostack/protocol/__init__.py

Removed the obsolete build_ping_response export.

Modified nitrostack/transports/__init__.py

Removed exports for the deleted sidecar classes and helpers, including:

• DispatchStage
• IngressContext
• StatelessIngressPipeline
• StatelessTransportMiddleware
• wrap_stateless_transport
• is_task_wire_interception

The module now exposes only the remaining official transport helpers.

Modified nitrostack/transports/http.py

Updated the middleware documentation to state that it only normalises transport headers and does not perform JSON-RPC dispatch.

Added tests/test_mcp22_official_http_owner.py

Added focused regression tests proving that:

• The application no longer wraps the official HTTP app with the sidecar.
• Deleted sidecar modules are not present.
• Deleted sidecar symbols do not remain in production code.
• /mcp/health remains available.
• The official MCP server handles ping successfully.
• Stateless ping responses do not contain a default Mcp-Session-Id.
• Unknown methods return the standard JSON-RPC -32601 method-not-found error.

Review follow-up (this push)

CORS policy restored on the official app

McpCorsMiddleware (in transports/cors.py) applies the existing policy to /mcp and /subscriptions/listen: MCP_CORS_ALLOWED_ORIGINS is honoured (no * fallback when an allowlist is set), preflight returns 204 and echoes requested Mcp-Param-* headers, and Mcp-Method, Mcp-Name and MCP-Protocol-Version are exposed. Mcp-Session-Id is exposed only on the legacy (sessionful) wire. Other routes keep the previous permissive CORS.

Modern era rejects the 2025 initialize

The official ServerRunner handles initialize itself, so the old initialize_handler hook never ran. A Server.middleware entry now raises Method not found: initialize (-32601) when rejects_legacy_initialize(era) is true.

Request context from one place

The same middleware sets request_ctx once for every handler. The per-handler copies in tools/call, resources/read, prompts/get, the four task handlers and notifications/initialized are removed, so tools/list and the other list handlers now see it too.

One caller_identity helper

nitrostack/runtime/caller.py::caller_identity(rc, era) returns (session_id, subject). Subject is the sub of a verified bearer token only; unsigned userId and _meta are never identity. A session id is reported only on the sessionful wire. Transforms and extract_task_access_context(rc, era) both use it.

TransformContext populated

session_id, new subject, and execution_context are filled for tools/list and tools/call.

The 21 parked tests (no xfail(run=False) remains)

• Ported (7): the two OPTIONS-scope tests, NITRO_MCP_PROTOCOL_VERSION env test, era session coexistence, CORS expose headers, auto-era initialize and discover on one /mcp (expectations updated to the official handler), modern initialize rejection (only the initialize assertions; the rest moved to [mcp-2026] Replace sidecar tests with a TestClient matrix; drop ping exports #27).
• Deleted (5): header-only ping tests (TestPingFastPath x3, TestHeaderTriggeredPing x2). [mcp-2026] Remove JSON-RPC sidecar; one /mcp owner (official mcp 2.x) #22 drops that behaviour.
• Moved to [mcp-2026] Replace sidecar tests with a TestClient matrix; drop ping exports #27 (9): incoming Mcp-Session-Id rejection on modern/auto (x2), forged session id association, GET /mcp rejecting a session id, required Mcp-Name, required Mcp-Method, protocol-version header cross-check, unsupported-version rejection, response echo headers. These were sidecar-only rules; the tests are removed here and [mcp-2026] Replace sidecar tests with a TestClient matrix; drop ping exports #27 should re-add them against the official path. notifications/initialized rejection on modern is also part of [mcp-2026] Replace sidecar tests with a TestClient matrix; drop ping exports #27.

New tests (tests/test_mcp22_official_http_owner.py)

HTTP-level transform context on tools/list, RegexSearchTransform end to end (search_tools then call_tool), legacy session id in TransformContext, modern initialize rejection, CORS allowlist and preflight, session-id exposure per era, caller_identity and task-access parity.

Branch

develop merged in (merge commit, no rebase, no force push).

Verification

• Full suite: pytest tests passes with no xfail/skip marks added by this PR; tests/test_mcp22_official_http_owner.py now has 13 tests.
• Source scan confirmed that duplicate sidecar symbols are absent from production code.
• Health endpoint verification passed.
• Official MCP ping verification passed.
• Unknown-method JSON-RPC error verification passed.
• git diff --check passed.
• No second JSON-RPC dispatcher was added.
• No live Letivo or external business API request was made.

Result

The /mcp endpoint now has one clear owner: the official MCP SDK Streamable HTTP implementation. This removes conflicting request paths, keeps protocol behaviour consistent, and makes future MCP 2026 changes safer to maintain.

[Shreyavemana]

I tested PR #34 locally.

• The new test file passes all the 5 tests.
• However, running the full test suite fails during test collection because existing tests still import modules and functions removed by this PR:
  • test_mcp20_blueprint.py — missing nitrostack.transports.dispatch
  • test_mcp20_deprecated.py — missing nitrostack.transports.dispatch
  • test_mcp20_jsonrpc_wire.py — missing nitrostack.transports.dispatch
  • test_mcp20_stateless_http.py — cannot import build_ping_response from nitrostack.protocol.jsonrpc

Please update or remove the affected tests as appropriate and rerun the full test suite.

[manish-wekan]

Thanks. Removing the sidecar itself looks right, but merged onto current develop this PR has two regressions on auto/modern.

First, CORS falls back to Access-Control-Allow-Origin: *, so MCP_CORS_ALLOWED_ORIGINS is ignored, and the Mcp-* expose headers are gone. Second, modern now accepts the 2025 initialize handshake, which it should reject.

Please move the existing transports/cors.py policy onto the build_http_app result (or land #36 alongside), and reject initialize on modern in the official handler path.

Also, please don't park the 21 tests as xfail(run=False): port each one, delete the ones #22 intends to drop (header-only ping), or move them to #27, and say which in the description.

Finally, the request-context items from the #22 comment are still open. Please include them here or link a follow-up issue.