🤯 MCP Gateway #1343

roh26it · 2025-09-15T21:47:30Z

https://portkey.ai/docs/product/mcp-gateway

Implements a comprehensive MCP (Model Context Protocol) Gateway that provides: - **Multi-transport Gateway**: Bridges clients and upstream MCP servers with automatic transport detection and translation (Streamable HTTP ↔ SSE) - **Session Persistence**: JSON-based session storage with automatic recovery across server restarts - **State Management**: Explicit session states (NEW, INITIALIZING, ACTIVE, DORMANT, CLOSED) with proper lifecycle handling - **Transport Translation**: Seamless conversion between different transport protocols for maximum compatibility - **Tool Management**: Configurable tool filtering with allowlists, blocklists, and rate limiting - **Production Logging**: Environment-aware logging system (minimal in production, verbose in development) - **Graceful Shutdown**: Proper cleanup and session saving on SIGINT/SIGTERM Core components: - `src/mcp-index.ts`: Main gateway HTTP server with Hono framework - `src/services/mcpSession.ts`: Session management with transport bridging - `src/services/sessionStore.ts`: Persistent storage with Redis migration path - `src/start-mcp.ts`: Server startup script with loading animation - `src/utils/logger.ts`: Configurable logging system - `src/types/mcp.ts`: TypeScript definitions for MCP gateway Features: - Automatic upstream transport detection (Streamable HTTP → SSE fallback) - Client session restoration after server restarts - Rate limiting and tool access policies - Health check endpoint with session statistics - Redis-ready architecture for horizontal scaling Dependencies: - Added @modelcontextprotocol/sdk for MCP protocol support - Added data/sessions.json to gitignore for persistent session storage

…lution

…reamline project structure

…nsistency

…refactor authorization flow in OAuthGateway

…vices

…patibility with new SDK structure

…cessary close logic and enhancing user instructions

…in MCP server configuration retrieval

…n management in control plane

… improved clarity and maintainability

…CRUD operations and cache statistics

…-index.ts and organizing related files into a dedicated mcp directory

matter-code-review · 2025-09-15T21:50:06Z

Description

Summary By MatterAI

🔄 What Changed

This Pull Request fixes a minor bug in the createWWWAuthenticateHeader function within src/mcp/middleware/oauth/index.ts. Specifically, a missing closing double quote " was added to the resource_metadata value in the generated WWW-Authenticate header string.

🔍 Impact of the Change

The change ensures that the WWW-Authenticate header is correctly formatted according to RFC 9728. Previously, the malformed header could lead to issues in clients attempting to parse the resource_metadata parameter, potentially causing authentication failures or incorrect resource discovery. The fix guarantees proper OAuth challenge handling.

📁 Total Files Changed

src/mcp/middleware/oauth/index.ts: Fixed a missing closing double quote in the WWW-Authenticate header string.

🧪 Test Added

N/A

🔒Security Vulnerabilities

N/A (This change is a bug fix that improves the correctness of a security-related header, it does not introduce new vulnerabilities.)

Motivation

This PR addresses a bug where the WWW-Authenticate header was malformed due to a missing closing double quote, ensuring proper OAuth challenge responses.

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Refactoring (no functional changes)

How Has This Been Tested?

Unit Tests
Integration Tests
Manual Testing

Screenshots (if applicable)

N/A

Checklist

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes

Related Issues

N/A

Caution

Package Vulnerabilities

Package	Version	CVE	Fix Version	Vulnerability
@hono/node-server	`^1.3.3`	CVE-2024-32652	`1.10.1`	@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed
@hono/node-server	`^1.3.3`	CVE-2024-23340	`1.4.1`	@hono/node-server cannot handle "double dots" in URL
hono	`^4.6.10`	CVE-2025-59139	`4.9.7`	Hono has Body Limit Middleware Bypass
rollup	`^4.9.1`	CVE-2024-47068	`4.22.4`	DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Tanka Poem ♫

Quote now in its place,
Header shines, a perfect form.
Auth flows, smooth and clear,
No more parsing woes appear,
Tiny fix, great impact. ✨

Sequence Diagram

sequenceDiagram
    participant OAuthMiddleware
    participant HeaderUtil as createWWWAuthenticateHeader(baseUrl, path)
    
    OAuthMiddleware->>HeaderUtil: Call with baseUrl, path
    Note over HeaderUtil: Fix: Add missing closing quote to resource_metadata
    HeaderUtil-->>OAuthMiddleware: Returns corrected WWW-Authenticate header

matter-code-review

The pull request introduces a new MCP Gateway with significant changes across multiple files. Key areas include OAuth implementation, session management, and cache backends. The changes are extensive and require careful review to ensure correctness and security.

Skipped files

data/servers.example.json: Skipped file pattern
docs/logging-config.md: Skipped file pattern
docs/security/session-hijacking-mitigation.md: Skipped file pattern
docs/security/token-passthrough-prevention.md: Skipped file pattern
docs/session-persistence.md: Skipped file pattern
package-lock.json: Skipped file pattern
wrangler-mcp.toml: Skipped file pattern
wrangler.toml: Skipped file pattern

matter-code-review · 2025-09-15T21:51:17Z

package.json

    "async-retry": "^1.3.3",
    "avsc": "^5.7.7",
    "hono": "^4.6.10",
+    "ioredis": "^5.7.0",


🐛 Bug Fix

Issue: Duplicate dependency ioredis and missing cleanup.
Fix: Remove duplicate ioredis and ensure proper cleanup.
Impact: Reduces package size and avoids potential conflicts.

Suggested change

"ioredis": "^5.7.0",

"@modelcontextprotocol/sdk": "^1.17.3",

"@portkey-ai/mustache": "^2.1.3",

"@smithy/signature-v4": "^2.1.1",

"@types/mustache": "^4.2.5",

"async-retry": "^1.3.3",

"avsc": "^5.7.7",

"hono": "^4.6.10",

"jose": "^6.0.11",

"minimist": "^1.2.8",

"openid-client": "^6.7.1",

"patch-package": "^8.0.0",

"ws": "^8.18.0",

"zod": "^3.22.4"

matter-code-review · 2025-09-15T21:51:17Z

src/mcp/handlers/mcpHandler.ts

+  if (!tokenInfo?.client_id) {
+    logger.debug('No client_id in tokenInfo, skipping OAuth token purge');
+    return;


🐛 Bug Fix

Issue: Potential null pointer exception if tokenInfo is null or undefined.
Fix: Add null check before accessing tokenInfo.client_id.
Impact: Prevents runtime errors.

Suggested change

if (!tokenInfo?.client_id) {

logger.debug('No client_id in tokenInfo, skipping OAuth token purge');

return;

if (!tokenInfo?.client_id) {

logger.debug('No client_id in tokenInfo, skipping OAuth token purge');

return;

}

✅ Resolved: Null check for tokenInfo.client_id is no longer needed as tokenInfo is not used in this function

matter-code-review · 2025-09-15T21:51:17Z

src/mcp/handlers/mcpHandler.ts

+    logger.error(
+      `Failed to prepare session ${sessionId} for SSE messages`,
+      error
+    );


🐛 Bug Fix

Issue: Inconsistent error handling for session restoration.
Fix: Ensure consistent error handling and logging.
Impact: Improves debugging and error tracking.

Suggested change

logger.error(

`Failed to prepare session ${sessionId} for SSE messages`,

error

);

logger.error(

`Failed to prepare session ${session.id} for SSE messages`,

error

);

✅ Resolved: Error handling for session restoration is now consistent with other error handling in the file

matter-code-review · 2025-09-15T21:51:18Z

src/mcp/mcp-index.ts

+  '*',
+  cors({
+    origin: '*', // Configure appropriately for production
+    allowHeaders: [
+      'Content-Type',
+      'Authorization',
+      'mcp-session-id',
+      'mcp-protocol-version',
+    ],
+    exposeHeaders: ['mcp-session-id', 'WWW-Authenticate'],
+    credentials: true, // Allow cookies and authorization headers
+  })


🐛 Bug Fix

Issue: Potential security risk with wildcard CORS origin.
Fix: Configure CORS origin appropriately for production.
Impact: Enhances security by restricting allowed origins.

Suggested change

'*',

cors({

origin: '*', // Configure appropriately for production

allowHeaders: [

'Content-Type',

'Authorization',

'mcp-session-id',

'mcp-protocol-version',

],

exposeHeaders: ['mcp-session-id', 'WWW-Authenticate'],

credentials: true, // Allow cookies and authorization headers

})

cors({

origin: process.env.CORS_ORIGIN || '*', // Configure appropriately for production

allowHeaders: [

'Content-Type',

'Authorization',

'mcp-session-id',

'mcp-protocol-version',

],

exposeHeaders: ['mcp-session-id', 'WWW-Authenticate'],

credentials: true, // Allow cookies and authorization headers

})

matter-code-review · 2025-09-15T21:51:18Z

src/mcp/middleware/cacheBackend/index.ts

+export const cacheBackendMiddleware = createMiddleware(
+  async (c: Context, next) => {
+    createCacheBackendsCF(env(c));
+    return next();
+  }
+);


🐛 Bug Fix

Issue: Missing error handling for cache backend creation.
Fix: Add error handling to catch and log potential issues.
Impact: Improves robustness of cache backend initialization.

Suggested change

export const cacheBackendMiddleware = createMiddleware(

async (c: Context, next) => {

createCacheBackendsCF(env(c));

return next();

}

);

export const cacheBackendMiddleware = createMiddleware(

async (c: Context, next) => {

try {

createCacheBackendsCF(env(c));

return next();

} catch (error) {

console.error('Failed to create cache backends:', error);

return next(); // Continue without cache

}

}

);

matter-code-review · 2025-09-15T21:51:19Z

src/mcp/utils/oauthTokenRevocation.ts

+  if (tokenInfo.refresh_token) {
+    // Try control plane first if available
+    if (controlPlane) {


🐛 Bug Fix

Issue: Potential null pointer exception if tokenInfo is null.
Fix: Add null check before accessing tokenInfo.refresh_token.
Impact: Prevents runtime errors.

Suggested change

if (tokenInfo.refresh_token) {

// Try control plane first if available

if (controlPlane) {

if (tokenInfo?.refresh_token) {

// Try control plane first if available

if (controlPlane) {

✅ Resolved: Null check for tokenInfo.refresh_token is no longer needed as tokenInfo is accessed safely

matter-code-review · 2025-09-15T21:51:19Z

src/public/index.html

+        <div class="card-subtitle">Gateway configs allow you to route requests to different providers and models. You
+          can load balance, set fallbacks, and configure automatic retries & timeouts. <a href="#">Learn more</a></div>


🐛 Bug Fix

Issue: Potential XSS vulnerability due to direct insertion of user input into HTML.
Fix: Sanitize user input before inserting into HTML.
Impact: Prevents XSS attacks.

Suggested change

<div class="card-subtitle">Gateway configs allow you to route requests to different providers and models. You

can load balance, set fallbacks, and configure automatic retries & timeouts. <a href="#">Learn more</a></div>

<div class="card-subtitle">Gateway configs allow you to route requests to different providers and models. You

can load balance, set fallbacks, and configure automatic retries & timeouts. <a href="#">Learn more</a></div>

matter-code-review · 2025-09-15T21:51:20Z

src/shared/services/cache/backends/cloudflareKV.ts

+  get = async (key: string): Promise<string | null> => {
+    return await this.KV.get(key);
+  };


🐛 Bug Fix

Issue: Potential null pointer exception if this.KV is null.
Fix: Add null check before accessing this.KV.
Impact: Prevents runtime errors.

Suggested change

get = async (key: string): Promise<string | null> => {

return await this.KV.get(key);

};

get = async (key: string): Promise<string | null> => {

if (!this.KV) return null;

return await this.KV.get(key);

};

✅ Resolved: Null check for this.KV is no longer needed as KV is initialized before use

matter-code-review · 2025-09-15T21:51:20Z

src/shared/services/cache/backends/redis.ts

+  private getFullKey(key: string, namespace?: string): string {
+    return namespace
+      ? `${this.dbName}:${namespace}:${key}`
+      : `${this.dbName}:default:${key}`;
+  }


🐛 Bug Fix

Issue: Potential null pointer exception if this.client is null.
Fix: Add null check before accessing this.client.
Impact: Prevents runtime errors.

Suggested change

private getFullKey(key: string, namespace?: string): string {

return namespace

? `${this.dbName}:${namespace}:${key}`

: `${this.dbName}:default:${key}`;

}

private getFullKey(key: string, namespace?: string): string {

if (!this.client) return '';

return namespace

? `${this.dbName}:${namespace}:${key}`

: `${this.dbName}:default:${key}`;

}

✅ Resolved: Null check for this.client is no longer needed as client is initialized before use

matter-code-review · 2025-09-15T21:51:20Z

src/start-server.ts

+// Extract the port number and flags from command line arguments using minimist
 const defaultPort = 8787;
-const args = process.argv.slice(2);
-const portArg = args.find((arg) => arg.startsWith('--port='));
-const port = portArg ? parseInt(portArg.split('=')[1]) : defaultPort;
+const defaultMCPPort = process.env.PORT || 8788;
+
+const argv = minimist(process.argv.slice(2), {
+  default: {
+    port: defaultPort,
+    'mcp-port': defaultMCPPort,
+  },
+  boolean: ['llm-node', 'mcp-node', 'llm-grpc', 'headless'],
+});
+
+const port = argv.port;
+const mcpPort = argv['mcp-port'];

-const isHeadless = args.includes('--headless');
+// Add flags to choose what all to start (llm-node, llm-grpc, mcp-node)
+// Default starts both llm-node and mcp-node
+
+let llmNode = argv['llm-node'];
+let mcpNode = argv['mcp-node'];
+let llmGrpc = argv['llm-grpc'];
+
+if (!llmNode && !mcpNode && !llmGrpc) {
+  llmNode = true;
+  mcpNode = true;
+}
+
+const isHeadless = argv.headless;

 // Setup static file serving only if not in headless mode
 if (


🐛 Bug Fix

Issue: Potential port conflict if default ports are already in use.
Fix: Add error handling for port conflicts.
Impact: Prevents crashes due to port conflicts.

Suggested change

// Extract the port number and flags from command line arguments using minimist

const defaultPort = 8787;

const args = process.argv.slice(2);

const portArg = args.find((arg) => arg.startsWith('--port='));

const port = portArg ? parseInt(portArg.split('=')[1]) : defaultPort;

const defaultMCPPort = process.env.PORT || 8788;

const argv = minimist(process.argv.slice(2), {

default: {

port: defaultPort,

'mcp-port': defaultMCPPort,

},

boolean: ['llm-node', 'mcp-node', 'llm-grpc', 'headless'],

});

const port = argv.port;

const mcpPort = argv['mcp-port'];

const isHeadless = args.includes('--headless');

// Add flags to choose what all to start (llm-node, llm-grpc, mcp-node)

// Default starts both llm-node and mcp-node

let llmNode = argv['llm-node'];

let mcpNode = argv['mcp-node'];

let llmGrpc = argv['llm-grpc'];

if (!llmNode && !mcpNode && !llmGrpc) {

llmNode = true;

mcpNode = true;

}

const isHeadless = argv.headless;

// Setup static file serving only if not in headless mode

if (

const port = argv.port;

const mcpPort = argv['mcp-port'];

// Add flags to choose what all to start (llm-node, llm-grpc, mcp-node)

// Default starts both llm-node and mcp-node

let llmNode = argv['llm-node'];

let mcpNode = argv['mcp-node'];

let llmGrpc = argv['llm-grpc'];

if (!llmNode && !mcpNode && !llmGrpc) {

llmNode = true;

mcpNode = true;

}

const isHeadless = argv.headless;

// Setup static file serving only if not in headless mode

if (!isHeadless) {

const serveIndex = serveStatic({ root: './src/public' });

// Set up routes

app.get('/public/logs', serveIndex);

app.get('/public/mcp', serveIndex);

app.get('/public/', serveIndex);

// Redirect `/public` to `/public/`

app.get('/public', (c) => {

return c.redirect('/public/');

});

}

// Loading animation function

async function showLoadingAnimation() {

const frames = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];

let i = 0;

return new Promise((resolve) => {

const interval = setInterval(() => {

process.stdout.write(`\

${frames[i]} Starting...`);

i = (i + 1) % frames.length;

}, 80);

setTimeout(() => {

clearInterval(interval);

resolve(null);

}, 2000);

});

}

// Clear the console and show animation before main output

await showLoadingAnimation();

console.clear();

if (mcpNode) {

const mcpUrl = `http://localhost:${mcpPort}`;

const mcpServer = serve({

fetch: mcpApp.fetch,

port: mcpPort,

});

console.log('\x1b[1m%s\x1b[0m', '🤯 MCP Gateway is running at:');

console.log(' ' + '\x1b[1;4;32m%s\x1b[0m', `${mcpUrl}`);

}

const url = `http://localhost:${port}`;

if (llmNode) {

const { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app });

app.get(

'/v1/realtime',

requestValidator,

upgradeWebSocket(realTimeHandlerNode)

);

const server = serve({

fetch: app.fetch,

port: port,

});

injectWebSocket(server);

console.log('\x1b[1m%s\x1b[0m', '🚀 AI Gateway is running at:');

console.log(' ' + '\x1b[1;4;32m%s\x1b[0m', `${url}`);

}

// Secondary information on single lines

if (!isHeadless) {

console.log('\

\

');

console.log(' ' + '\x1b[1m%s\x1b[0m', 'Public APIs:');

console.log(' ' + '\x1b[1;4m%s\x1b[0m', `${url}/public`);

console.log(' ' + '\x1b[1m%s\x1b[0m', 'Documentation:');

console.log(' ' + '\x1b[1;4m%s\x1b[0m', `${url}/docs`);

console.log(' ' + '\x1b[1m%s\x1b[0m', 'Health Check:');

console.log(' ' + '\x1b[1;4m%s\x1b[0m', `${url}/health`);

}

// Graceful shutdown

process.on('SIGINT', async () => {

console.log('\

\

Shutting down gracefully...');

if (llmNode) {

server.close();

}

if (mcpNode) {

mcpServer.close();

}

process.exit(0);

});

matter-code-review

Refactored MCP session handling and improved cache backend implementations. Removed unused imports and streamlined session initialization.

Skipped files

src/mcp/utils/emitLog.ts: File hunk diff too large

matter-code-review · 2025-09-16T08:31:04Z

src/mcp/handlers/mcpHandler.ts

+import { MCPSession, TransportType } from '../services/mcpSession';
+import { getSessionStore } from '../services/sessionStore';
+import { createLogger } from '../../shared/utils/logger';
+import { ControlPlane } from '../middleware/controlPlane';
+import { revokeAllClientTokens } from '../utils/oauthTokenRevocation';
+


🛠️ Code Refactor

Issue: Unused Transport import.
Fix: Remove unused import.
Impact: Reduces bundle size and improves clarity.

Suggested change

import { MCPSession, TransportType } from '../services/mcpSession';

import { getSessionStore } from '../services/sessionStore';

import { createLogger } from '../../shared/utils/logger';

import { ControlPlane } from '../middleware/controlPlane';

import { revokeAllClientTokens } from '../utils/oauthTokenRevocation';

import { MCPSession, TransportType } from '../services/mcpSession';

import { getSessionStore } from '../services/sessionStore';

import { createLogger } from '../../shared/utils/logger';

import { ControlPlane } from '../middleware/controlPlane';

import { revokeAllClientTokens } from '../utils/oauthTokenRevocation';

matter-code-review · 2025-09-16T08:31:04Z

src/mcp/handlers/mcpHandler.ts

+  c: Context<Env>,
+  session: MCPSession
+): Promise<any> {
+  // Ensure session is active or can be restored
+  try {
+    await session.initializeOrRestore();
+    logger.debug(`Session ${session.id} ready`);
+  } catch (error: any) {
+    logger.error(`Failed to prepare session ${session.id}`, error);


🛠️ Code Refactor

Issue: Unnecessary variable declaration for transport.
Fix: Remove unused variable.
Impact: Simplifies code and reduces memory usage.

Suggested change

c: Context<Env>,

session: MCPSession

): Promise<any> {

// Ensure session is active or can be restored

try {

await session.initializeOrRestore();

logger.debug(`Session ${session.id} ready`);

} catch (error: any) {

logger.error(`Failed to prepare session ${session.id}`, error);

): Promise<any> {

// Ensure session is active or can be restored

try {

await session.initializeOrRestore();

logger.debug(`Session ${session.id} ready`);

matter-code-review · 2025-09-16T08:31:04Z

src/mcp/handlers/mcpHandler.ts

+    return c.json(ErrorResponse.sessionRestoreFailed(), 500);
+  }
+
+  // Route based on transport type
+  if (session.getClientTransportType() === 'sse') {
+    const transport = session.initializeSSETransport();
+    await setSession(transport.sessionId, session);
+    await transport.start();
+  } else {


🛠️ Code Refactor

Issue: Unused req and res destructuring.
Fix: Remove unused destructuring.
Impact: Simplifies code and improves readability.

Suggested change

return c.json(ErrorResponse.sessionRestoreFailed(), 500);

}

// Route based on transport type

if (session.getClientTransportType() === 'sse') {

const transport = session.initializeSSETransport();

await setSession(transport.sessionId, session);

await transport.start();

} else {

// Route based on transport type

if (session.getClientTransportType() === 'sse') {

const transport = session.initializeSSETransport();

matter-code-review · 2025-09-16T08:31:04Z

src/mcp/handlers/mcpHandler.ts

+ * This is the optimized entry point that delegates to specific handlers
+ */
+export async function handleMCPRequest(c: Context<Env>) {
+  const { serverConfig } = c.var;
+  if (!serverConfig) return c.json(ErrorResponse.serverConfigNotFound(), 500);
+
+  let session: MCPSession | undefined = c.var.session;


🛠️ Code Refactor

Issue: Unused tokenInfo variable.
Fix: Remove unused variable.
Impact: Simplifies code and reduces memory usage.

Suggested change

* This is the optimized entry point that delegates to specific handlers

*/

export async function handleMCPRequest(c: Context<Env>) {

const { serverConfig } = c.var;

if (!serverConfig) return c.json(ErrorResponse.serverConfigNotFound(), 500);

let session: MCPSession | undefined = c.var.session;

export async function handleMCPRequest(c: Context<Env>) {

const { serverConfig } = c.var;

if (!serverConfig) return c.json(ErrorResponse.serverConfigNotFound(), 500);

matter-code-review · 2025-09-16T08:31:05Z

src/mcp/handlers/mcpHandler.ts

+}
+
+export async function handleSSERequest(c: Context<Env>) {
+  const { serverConfig } = c.var;
+  if (!serverConfig) return c.json(ErrorResponse.serverConfigNotFound(), 500);
+
+  let session: MCPSession | undefined = c.var.session;
+  const isSSE = c.req.header('Accept') === 'text/event-stream';
+
+  if (!isSSE) {


🛠️ Code Refactor

Issue: Unused tokenInfo and method variables.
Fix: Remove unused variables.
Impact: Simplifies code and reduces memory usage.

Suggested change

}

export async function handleSSERequest(c: Context<Env>) {

const { serverConfig } = c.var;

if (!serverConfig) return c.json(ErrorResponse.serverConfigNotFound(), 500);

let session: MCPSession | undefined = c.var.session;

const isSSE = c.req.header('Accept') === 'text/event-stream';

if (!isSSE) {

export async function handleSSERequest(c: Context<Env>) {

const { serverConfig } = c.var;

if (!serverConfig) return c.json(ErrorResponse.serverConfigNotFound(), 500);

let session: MCPSession | undefined = c.var.session;

const isSSE = c.req.header('Accept') === 'text/event-stream';

matter-code-review · 2025-09-16T08:31:07Z

src/shared/services/cache/backends/file.ts

+    let expiredCount = 0;
+    let hasChanges = false;
+
+    for (const [, namespaceData] of Object.entries(this.data)) {
+      for (const [key, entry] of Object.entries(namespaceData)) {
+        if (this.isExpired(entry)) {
+          delete namespaceData[key];


🛠️ Code Refactor

Issue: Unused namespace variable in loop.
Fix: Remove unused variable.
Impact: Simplifies code.

Suggested change

let expiredCount = 0;

let hasChanges = false;

for (const [, namespaceData] of Object.entries(this.data)) {

for (const [key, entry] of Object.entries(namespaceData)) {

if (this.isExpired(entry)) {

delete namespaceData[key];

let hasChanges = false;

for (const [, namespaceData] of Object.entries(this.data)) {

for (const [key, entry] of Object.entries(namespaceData)) {

if (this.isExpired(entry)) {

matter-code-review · 2025-09-16T08:31:07Z

src/shared/services/cache/backends/memory.ts

+  }
+
+  async cleanup(): Promise<void> {
+    let expiredCount = 0;
+
+    for (const [key, entry] of this.cache.entries()) {


🛠️ Code Refactor

Issue: Unused now variable.
Fix: Remove unused variable.
Impact: Simplifies code.

Suggested change

}

async cleanup(): Promise<void> {

let expiredCount = 0;

for (const [key, entry] of this.cache.entries()) {

async cleanup(): Promise<void> {

let expiredCount = 0;

for (const [key, entry] of this.cache.entries()) {

matter-code-review · 2025-09-16T08:31:07Z

src/shared/services/cache/index.ts

+}
+
+export function createCacheBackendsRedis(redisUrl: string): void {
+  logger.info('Creating cache backends with Redis', redisUrl);
+  let commonOptions: CacheConfig = {
+    backend: 'redis',
+    redisUrl: redisUrl,


🛠️ Code Refactor

Issue: Using console.log instead of logger.
Fix: Use logger for consistency.
Impact: Improves logging consistency.

Suggested change

}

export function createCacheBackendsRedis(redisUrl: string): void {

logger.info('Creating cache backends with Redis', redisUrl);

let commonOptions: CacheConfig = {

backend: 'redis',

redisUrl: redisUrl,

export function createCacheBackendsRedis(redisUrl: string): void {

logger.info('Creating cache backends with Redis', redisUrl);

let commonOptions: CacheConfig = {

matter-code-review · 2025-09-16T08:31:07Z

src/shared/utils/logger.ts

+    };
+  }
+
+  private formatMessage(level: string, message: string): string {
+    const parts: string[] = [];
+
+    if (this.config.timestamp) {


🛠️ Code Refactor

Issue: Unused data parameter in formatMessage.
Fix: Remove unused parameter.
Impact: Simplifies function signature.

Suggested change

};

}

private formatMessage(level: string, message: string): string {

const parts: string[] = [];

if (this.config.timestamp) {

private formatMessage(level: string, message: string): string {

const parts: string[] = [];

if (this.config.timestamp) {

matter-code-review · 2025-09-16T08:31:07Z

src/shared/utils/logger.ts

+  private log(level: LogLevel, levelName: string, message: string, data?: any) {
+    if (level > this.config.level) return;
+
+    const formattedMessage = this.formatMessage(levelName, message);
+    const color = this.config.colors
+      ? this.colors[levelName as keyof typeof this.colors]
+      : '';


🛠️ Code Refactor

Issue: Unused data parameter in formatMessage call.
Fix: Remove unused parameter.
Impact: Simplifies function call.

Suggested change

private log(level: LogLevel, levelName: string, message: string, data?: any) {

if (level > this.config.level) return;

const formattedMessage = this.formatMessage(levelName, message);

const color = this.config.colors

? this.colors[levelName as keyof typeof this.colors]

: '';

private log(level: LogLevel, levelName: string, message: string, data?: any) {

if (level > this.config.level) return;

const formattedMessage = this.formatMessage(levelName, message);

const color = this.config.colors

…om 7 days to 30 minutes and adjust save interval to 1 second

matter-code-review

Low complexity changes with minor cleanup and configuration adjustments.

matter-code-review · 2025-09-16T08:42:22Z

src/mcp/services/upstream.ts

+    private upstreamSessionId?: string,
+    private controlPlane?: ControlPlane
+  ) {
+    this.client = new Client(


📝 Documentation Gap

Issue: TODO comment indicates incomplete implementation.
Fix: Either implement capability advertisement or remove TODO with explanation.
Impact: Improves code clarity and completeness.

…mline middleware flow

matter-code-review

Session middleware removal and cache TTL/save interval adjustments reviewed.

matter-code-review · 2025-09-16T09:57:51Z

src/mcp/mcp-index.ts

+} from './handlers/mcpHandler';
+import { oauthMiddleware } from './middleware/oauth';
+import { hydrateContext } from './middleware/hydrateContext';
+import { oauthRoutes } from './routes/oauth';
+import { wellKnownRoutes } from './routes/wellknown';
+import { adminRoutes } from './routes/admin';


🛠️ Code Refactor

Issue: sessionMiddleware import and usage removed but not commented.
Fix: Add comment explaining removal rationale for future maintainers.
Impact: Improves code clarity and intent communication.

matter-code-review · 2025-09-16T09:57:52Z

src/mcp/mcp-index.ts

+    skipPaths: ['/oauth', '/.well-known'],
+  }),
+  hydrateContext,
+  async (c) => {
+    return handleMCPRequest(c);
+  }


🛠️ Code Refactor

Issue: sessionMiddleware removed from middleware chain without explanation.
Fix: Add inline comment clarifying intentional removal.
Impact: Prevents confusion during future debugging/maintenance.

matter-code-review · 2025-09-16T09:57:52Z

src/mcp/mcp-index.ts

+    skipPaths: ['/oauth', '/.well-known'],
+  }),
+  hydrateContext,
+  async (c) => {
+    return handleSSERequest(c);
+  }


🛠️ Code Refactor

Issue: sessionMiddleware removed from SSE request chain.
Fix: Document removal reason in code.
Impact: Maintains clear audit trail of middleware changes.

matter-code-review · 2025-09-16T09:57:52Z

src/mcp/mcp-index.ts

+    skipPaths: ['/oauth', '/.well-known'],
+  }),
+  hydrateContext,
+  async (c) => {
+    return handleSSEMessages(c);
+  }


🛠️ Code Refactor

Issue: sessionMiddleware removed from SSE messages chain.
Fix: Add explanatory comment for middleware removal.
Impact: Ensures future developers understand architectural decisions.

matter-code-review · 2025-09-16T09:57:52Z

src/mcp/middleware/sessionMiddleware.ts

+// REMOVED FROM FLOW FOR LATER!!!
+


📝 Documentation Gap

Issue: Comment indicates session middleware was intentionally removed from flow.
Fix: Either restore middleware or remove file if permanently deprecated.
Impact: Reduces dead code and improves repository hygiene.

…using getBaseUrl utility

…sh token handling and improving debug logging

matter-code-review

Bug fixes and refactoring in OAuth token revocation logic

matter-code-review · 2025-09-18T10:08:47Z

src/mcp/utils/oauthTokenRevocation.ts

+    if (controlPlane) {
+      try {
+        await controlPlane.revoke(
+          refreshToken!,


🐛 Bug Fix

Issue: Unsafe non-null assertion on refreshToken which could be null
Fix: Add proper null check before using refreshToken
Impact: Prevents potential runtime error

Suggested change

refreshToken!,

await controlPlane.revoke(

refreshToken ?? '',

'refresh_token',

tokenInfo.client_id

);

matter-code-review · 2025-09-18T10:08:47Z

src/mcp/utils/oauthTokenRevocation.ts

+  let refreshToken: string | null = null;
+
+  if (tokenInfo.refresh_token) {
+    refreshToken = tokenInfo.refresh_token;


🛠️ Code Refactor

Issue: Variable refreshToken declared twice in different scopes
Fix: Use single declaration and assignment
Impact: Improves code readability and reduces scope confusion

Suggested change

refreshToken = tokenInfo.refresh_token;

if (tokenInfo.refresh_token) {

refreshToken = tokenInfo.refresh_token;

matter-code-review · 2025-09-18T10:08:47Z

src/mcp/utils/oauthTokenRevocation.ts

+  // Always revoke locally (for cache cleanup)
+  await revokeOAuthToken(
+    tokenInfo.refresh_token,
+    tokenInfo.client_id,
+    'refresh_token'
+  );


⚡️ Performance Improvement

Issue: Unnecessary local token revocation when refresh token is missing
Fix: Skip local revocation if no refresh token exists
Impact: Avoids redundant function calls

Suggested change

// Always revoke locally (for cache cleanup)

await revokeOAuthToken(

tokenInfo.refresh_token,

tokenInfo.client_id,

'refresh_token'

);

// Always revoke locally (for cache cleanup)

if (tokenInfo.refresh_token) {

await revokeOAuthToken(

tokenInfo.refresh_token,

tokenInfo.client_id,

'refresh_token'

);

}

…check response

matter-code-review

Added control plane handling in OAuth routes with early return for unimplemented paths.

matter-code-review · 2025-09-22T22:14:36Z

src/mcp/routes/oauth.ts

+  };
+  Variables: {
+    gateway: OAuthGateway;
+    controlPlane?: any;


🐛 Bug Fix

Issue: controlPlane property added without type definition
Fix: Add proper type instead of any
Impact: Improves type safety and maintainability

Suggested change

controlPlane?: any;

controlPlane?: ControlPlaneType;

…rt cmd

… missing closing quote

matter-code-review · 2025-09-23T10:38:12Z

Fix missing closing quote in WWW-Authenticate header string literal

roh26it added 30 commits August 17, 2025 16:22

Using session state flags and getter/setters

44d8a4a

Moved handler function into it's own file

1f75837

Adding OAuth support to the MCP Gateway

58e10cd

Simplified client registration flow

abf2034

Improved consent dialog box

f46eda7

Refactored to move all data objects in the root of the repo

6020dce

Better Security

c1748f2

Implemented refresh_token

25dd48c

Running it on 8789 by default now

2f861eb

Abstracted caches into a single handler. Minor cleanup

1b3a3aa

http <> sse, sse<>sse, sse<>http and oauth local work now

8293b76

Implemented prompts, resources, resource templates, logging, ping

a6ec4b5

Control Plane is now attached as a middleware

ecdda4c

feat: workspace id scoping to mcp server ids

f6f3833

chore: cache improvements

bfa872d

chore: start-server now manages both llm and mcp gateways using minimist

4ed6602

fix: build now works

2eb7336

fix: add .js extension to MCP SDK type imports for proper module reso…

ad5842d

…lution

chore: start-server starts mcp server as well

0b8d74c

feat: support control plane for upstreamAuth

fb7e885

Cache changes to make it work with workerd

33fd796

Error logging on wrangler

6a1f577

chore: minor cache fixes

b5cb4bc

fix: remove graceful stop for now

f30f7d7

chore: cleanup hydrateContext

c989209

chore: better auth window

108b245

chore: better caching

b357e70

chore: default logger to info

65b8777

chore: reorg files

a1b6940

roh26it added 12 commits September 11, 2025 19:31

chore: remove example OAuth configuration and token cache files to st…

3921f06

…reamline project structure

fix: update ControlPlane request URL to include versioning for API co…

4533b7a

…nsistency

feat: integrate GatewayOAuthProvider for improved OAuth handling and …

97a8fbe

…refactor authorization flow in OAuthGateway

feat: enhance OAuth error handling and token purging logic in MCP ser…

26c1936

…vices

fix: update import path for auth module in oauthGateway to ensure com…

8fef84d

…patibility with new SDK structure

refactor: simplify redirect handling in OAuthGateway by removing unne…

7ad20ae

…cessary close logic and enhancing user instructions

fix: update default auth type to 'none' and transport type to 'http' …

8cbff00

…in MCP server configuration retrieval

feat: implement OAuth token revocation utilities and enhance MCP toke…

052436c

…n management in control plane

refactor: update revokeAllClientTokens to accept tokenInfo object for…

0edc410

… improved clarity and maintainability

chore: remove unused dotenv import from mcp-index.ts to clean up code

a28e416

feat: add admin routes for managing MCP servers and cache, including …

1d8fd24

…CRUD operations and cache statistics

refactor: restructure MCP Gateway by moving start-mcp.ts logic to mcp…

ea5c36b

…-index.ts and organizing related files into a dedicated mcp directory

matter-code-review bot reviewed Sep 15, 2025

View reviewed changes

chore: lint checks

7833985

matter-code-review bot reviewed Sep 16, 2025

View reviewed changes

refactor: update cache backend configuration to reduce default TTL fr…

ac5835b

…om 7 days to 30 minutes and adjust save interval to 1 second

matter-code-review bot reviewed Sep 16, 2025

View reviewed changes

refactor: remove sessionMiddleware from MCP request handling to strea…

13521bf

…mline middleware flow

matter-code-review bot reviewed Sep 16, 2025

View reviewed changes

roh26it added 2 commits September 16, 2025 19:00

refactor: centralize base URL retrieval in MCP routes and middleware …

c66fc00

…using getBaseUrl utility

refactor: enhance revokeAllClientTokens function by simplifying refre…

ea8315b

…sh token handling and improving debug logging

matter-code-review bot reviewed Sep 18, 2025

View reviewed changes

VisargD added 3 commits September 23, 2025 01:50

merge main into feat/mcp

eb2db4d

chore: remove unnecessary session and uptime information from health …

10b0506

…check response

feat: add controlPlane check in OAuth middleware

bd02b8b

matter-code-review bot reviewed Sep 22, 2025

View reviewed changes

VisargD added 2 commits September 23, 2025 16:06

fix: keep default llm gateway as default if no args are passed in sta…

8b93fa7

…rt cmd

fix: correct syntax in createWWWAuthenticateHeader function by adding…

6c15eee

… missing closing quote

-    "ioredis": "^5.7.0",
+    "@modelcontextprotocol/sdk": "^1.17.3",
+    "@portkey-ai/mustache": "^2.1.3",
+    "@smithy/signature-v4": "^2.1.1",
+    "@types/mustache": "^4.2.5",
+    "async-retry": "^1.3.3",
+    "avsc": "^5.7.7",
+    "hono": "^4.6.10",
+    "jose": "^6.0.11",
+    "minimist": "^1.2.8",
+    "openid-client": "^6.7.1",
+    "patch-package": "^8.0.0",
+    "ws": "^8.18.0",
+    "zod": "^3.22.4"

		<div class="card-subtitle">Gateway configs allow you to route requests to different providers and models. You
		can load balance, set fallbacks, and configure automatic retries & timeouts. <a href="#">Learn more</a></div>

	refreshToken = tokenInfo.refresh_token;
	if (tokenInfo.refresh_token) {
	refreshToken = tokenInfo.refresh_token;

🤯 MCP Gateway #1343

Are you sure you want to change the base?

🤯 MCP Gateway #1343

Uh oh!

Conversation

roh26it commented Sep 15, 2025

Uh oh!

matter-code-review bot commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Summary By MatterAI

🔄 What Changed

🔍 Impact of the Change

📁 Total Files Changed

🧪 Test Added

🔒Security Vulnerabilities

Motivation

Type of Change

How Has This Been Tested?

Screenshots (if applicable)

Checklist

Related Issues

Package Vulnerabilities

Tanka Poem ♫

Sequence Diagram

Uh oh!

matter-code-review bot left a comment

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot left a comment

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

matter-code-review bot commented Sep 15, 2025 •

edited

Loading