fix: negotiate MCP protocol version and evict idle sessions

lucarlig · lucarlig · commit fa8d0284897f · 2026-06-24T12:46:07.000+01:00
- Echo the client's requested protocolVersion when supported, else the
  latest version this server speaks (both SSE and streamable HTTP).
- Track last-seen time per streamable-HTTP session and evict idle ones
  past SESSION_IDLE_TTL instead of leaking until the cap is reached.
- get_stats now counts its own invocation like every other tool, and the
  unreachable session-id header fallback is dropped.

Signed-off-by: lucarlig &lt;luca.carlig@ibm.com&gt;
diff --git a/mcp-servers/rust/fast-time-server/src/app.rs b/mcp-servers/rust/fast-time-server/src/app.rs
@@ -1,4 +1,4 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 use axum::Router;
diff --git a/mcp-servers/rust/fast-time-server/src/config.rs b/mcp-servers/rust/fast-time-server/src/config.rs
@@ -1,11 +1,23 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
+use std::time::Duration;
+
 pub(crate) const DEFAULT_BIND_ADDRESS: &str = "0.0.0.0:9080";
 pub(crate) const APP_NAME: &str = "fast-time-server";
 pub(crate) const APP_VERSION: &str = env!("CARGO_PKG_VERSION");
 pub(crate) const MCP_PROTOCOL_VERSION: &str = "2025-11-25";
+/// Protocol versions echoed back during initialize negotiation; anything else
+/// falls back to `MCP_PROTOCOL_VERSION`.
+pub(crate) const SUPPORTED_PROTOCOL_VERSIONS: &[&str] = &[
+    "2024-11-05",
+    "2025-03-26",
+    "2025-06-18",
+    MCP_PROTOCOL_VERSION,
+];
 pub(crate) const SESSION_HEADER: &str = "mcp-session-id";
 pub(crate) const MAX_ACTIVE_SESSIONS: usize = 10_000;
+/// Idle lifetime for streamable-HTTP sessions before they are evicted.
+pub(crate) const SESSION_IDLE_TTL: Duration = Duration::from_secs(300);
 pub(crate) const SSE_CHANNEL_CAPACITY: usize = 64;
 pub(crate) const MAX_DELAY_MS: u64 = 60_000;
diff --git a/mcp-servers/rust/fast-time-server/src/delay.rs b/mcp-servers/rust/fast-time-server/src/delay.rs
@@ -1,4 +1,4 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 use rand_distr::Distribution;
diff --git a/mcp-servers/rust/fast-time-server/src/lib.rs b/mcp-servers/rust/fast-time-server/src/lib.rs
@@ -1,6 +1,6 @@
 // fast-time-server - Ultra-fast MCP server for performance testing
 //
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 mod app;
diff --git a/mcp-servers/rust/fast-time-server/src/main.rs b/mcp-servers/rust/fast-time-server/src/main.rs
@@ -1,6 +1,6 @@
 // fast-time-server - Ultra-fast MCP server for performance testing
 //
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 #[tokio::main]
diff --git a/mcp-servers/rust/fast-time-server/src/mcp.rs b/mcp-servers/rust/fast-time-server/src/mcp.rs
@@ -1,4 +1,4 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 use axum::body;
@@ -8,7 +8,7 @@ use chrono::Utc;
 use serde_json::json;
 use std::sync::atomic::{AtomicU64, Ordering};
 
-use crate::config::{APP_NAME, APP_VERSION, MCP_PROTOCOL_VERSION};
+use crate::config::{APP_NAME, APP_VERSION, MCP_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS};
 use crate::delay::{compute_delay, validate_delay};
 use crate::time::{parse_time_in_timezone, parse_timezone};
 
@@ -23,16 +23,30 @@ pub(crate) fn id_json(id: Option<&serde_json::Value>) -> String {
         .unwrap_or_else(|| "null".to_string())
 }
 
-pub(crate) fn initialize_body(id: Option<&serde_json::Value>) -> String {
+pub(crate) fn initialize_body(id: Option<&serde_json::Value>, protocol_version: &str) -> String {
     format!(
         r#"{{"jsonrpc":"2.0","id":{},"result":{{"protocolVersion":"{}","capabilities":{{"tools":{{}}}},"serverInfo":{{"name":"{}","version":"{}"}},"instructions":"Ultra-fast MCP test server."}}}}"#,
         id_json(id),
-        MCP_PROTOCOL_VERSION,
+        protocol_version,
         APP_NAME,
         APP_VERSION
     )
 }
 
+/// Echo back the client's requested protocol version when supported, otherwise
+/// advertise the latest version this server speaks.
+pub(crate) fn negotiate_protocol_version(req: &serde_json::Value) -> &'static str {
+    let requested = req
+        .get("params")
+        .and_then(|params| params.get("protocolVersion"))
+        .and_then(serde_json::Value::as_str);
+    SUPPORTED_PROTOCOL_VERSIONS
+        .iter()
+        .copied()
+        .find(|&supported| Some(supported) == requested)
+        .unwrap_or(MCP_PROTOCOL_VERSION)
+}
+
 pub(crate) fn tools_list_response(id: Option<&serde_json::Value>) -> Response {
     json_response(format!(
         r#"{{"jsonrpc":"2.0","id":{},"result":{{"tools":[{{"name":"echo","description":"Echo back the provided message.","inputSchema":{{"type":"object","properties":{{"message":{{"type":"string"}},"delay":{{"type":"integer","minimum":0,"maximum":60000}},"delay_stddev":{{"type":"number","minimum":0}}}},"required":["message"]}}}},{{"name":"get_system_time","description":"Get current system time in the specified IANA timezone.","inputSchema":{{"type":"object","properties":{{"timezone":{{"type":"string"}}}}}}}},{{"name":"convert_time","description":"Convert a time value from a source IANA timezone to a target IANA timezone.","inputSchema":{{"type":"object","properties":{{"time":{{"type":"string"}},"source_timezone":{{"type":"string"}},"target_timezone":{{"type":"string"}}}},"required":["time","source_timezone","target_timezone"]}}}},{{"name":"schema_error","description":"Always returns isError=true.","inputSchema":{{"type":"object","properties":{{}}}},"outputSchema":{{"type":"object","properties":{{"recognitionId":{{"type":"string"}},"message":{{"type":"string"}}}},"required":["recognitionId"]}}}},{{"name":"schema_success","description":"Returns a JSON payload that conforms to the declared outputSchema.","inputSchema":{{"type":"object","properties":{{}}}},"outputSchema":{{"type":"object","properties":{{"recognitionId":{{"type":"string"}},"message":{{"type":"string"}}}},"required":["recognitionId"]}}}},{{"name":"get_stats","description":"Get server statistics including request count and uptime.","inputSchema":{{"type":"object","properties":{{}}}}}}]}}}}"#,
@@ -113,7 +127,7 @@ pub(crate) async fn tools_call_response(
             )
         }),
         "get_stats" => {
-            let count = DIRECT_REQUEST_COUNT.load(Ordering::Relaxed);
+            let count = DIRECT_REQUEST_COUNT.fetch_add(1, Ordering::Relaxed) + 1;
             text_result_response(
                 id,
                 &format!(
@@ -173,7 +187,7 @@ pub(crate) async fn sse_message_response(req: &serde_json::Value) -> Option<Stri
         .and_then(serde_json::Value::as_str)
         .unwrap_or_default();
     let response = match method {
-        "initialize" => json_response(initialize_body(id)),
+        "initialize" => json_response(initialize_body(id, negotiate_protocol_version(req))),
         "ping" => empty_result_response(id),
         "tools/list" => tools_list_response(id),
         "tools/call" => tools_call_response(id, req).await,
diff --git a/mcp-servers/rust/fast-time-server/src/rest.rs b/mcp-servers/rust/fast-time-server/src/rest.rs
@@ -1,4 +1,4 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 use axum::extract::Query;
diff --git a/mcp-servers/rust/fast-time-server/src/time.rs b/mcp-servers/rust/fast-time-server/src/time.rs
@@ -1,4 +1,4 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 #[cfg(test)]
diff --git a/mcp-servers/rust/fast-time-server/src/transports/mod.rs b/mcp-servers/rust/fast-time-server/src/transports/mod.rs
@@ -1,4 +1,4 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 pub(crate) mod sse;
diff --git a/mcp-servers/rust/fast-time-server/src/transports/sse.rs b/mcp-servers/rust/fast-time-server/src/transports/sse.rs
@@ -1,4 +1,4 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 use axum::extract::Query;
@@ -171,10 +171,7 @@ mod tests {
             .expect("initialize response should be sent as SSE data");
         let body: serde_json::Value =
             serde_json::from_str(&message).expect("SSE message should be JSON-RPC");
-        assert_eq!(
-            body["result"]["protocolVersion"],
-            crate::config::MCP_PROTOCOL_VERSION
-        );
+        assert_eq!(body["result"]["protocolVersion"], "2024-11-05");
         assert_eq!(
             body["result"]["serverInfo"]["name"],
             crate::config::APP_NAME
diff --git a/mcp-servers/rust/fast-time-server/src/transports/streamable_http.rs b/mcp-servers/rust/fast-time-server/src/transports/streamable_http.rs
@@ -1,19 +1,22 @@
-// Copyright 2025
+// Copyright 2026
 // SPDX-License-Identifier: Apache-2.0
 
 use axum::http::{HeaderMap, HeaderValue, StatusCode};
 use axum::response::IntoResponse;
 use axum::response::Response;
 use serde_json::json;
-use std::collections::HashSet;
+use std::collections::HashMap;
 use std::sync::{LazyLock, RwLock};
+use std::time::Instant;
 use uuid::Uuid;
 
-use crate::config::{MAX_ACTIVE_SESSIONS, SESSION_HEADER};
+use crate::config::{MAX_ACTIVE_SESSIONS, SESSION_HEADER, SESSION_IDLE_TTL};
 use crate::mcp;
 
-static ACTIVE_SESSIONS: LazyLock<RwLock<HashSet<String>>> =
-    LazyLock::new(|| RwLock::new(HashSet::new()));
+/// Active sessions keyed by id, with the last time each was seen so idle
+/// sessions can be evicted instead of leaking until the cap is hit.
+static ACTIVE_SESSIONS: LazyLock<RwLock<HashMap<String, Instant>>> =
+    LazyLock::new(|| RwLock::new(HashMap::new()));
 
 pub(crate) async fn delete_handler(headers: HeaderMap) -> StatusCode {
     let Some(session_id) = session_id(&headers) else {
@@ -59,15 +62,15 @@ pub(crate) async fn handler(
     }
 
     match method {
-        "initialize" => initialize_response(id),
+        "initialize" => initialize_response(id, mcp::negotiate_protocol_version(&req)),
         _ => mcp::error_response(id, -32601, "Method not found", None),
     }
 }
 
-fn initialize_response(id: Option<&serde_json::Value>) -> Response {
+fn initialize_response(id: Option<&serde_json::Value>, protocol_version: &str) -> Response {
     let session_id = Uuid::new_v4().to_string();
-    let session_header = HeaderValue::from_str(&session_id)
-        .unwrap_or_else(|_| HeaderValue::from_static("fast-time"));
+    let session_header =
+        HeaderValue::from_str(&session_id).expect("uuid string is always a valid header value");
     if !remember_session(session_id) {
         return mcp::error_response_with_status(
             StatusCode::SERVICE_UNAVAILABLE,
@@ -77,7 +80,7 @@ fn initialize_response(id: Option<&serde_json::Value>) -> Response {
             Some(json!({ "max_sessions": MAX_ACTIVE_SESSIONS })),
         );
     }
-    let mut response = mcp::json_response(mcp::initialize_body(id));
+    let mut response = mcp::json_response(mcp::initialize_body(id, protocol_version));
     response
         .headers_mut()
         .insert(SESSION_HEADER, session_header);
@@ -86,38 +89,44 @@ fn initialize_response(id: Option<&serde_json::Value>) -> Response {
 
 fn remember_session(session_id: String) -> bool {
     if let Ok(mut sessions) = ACTIVE_SESSIONS.write() {
-        remember_session_in(&mut sessions, session_id)
+        remember_session_in(&mut sessions, session_id, Instant::now())
     } else {
         false
     }
 }
 
-fn remember_session_in(sessions: &mut HashSet<String>, session_id: String) -> bool {
+fn remember_session_in(
+    sessions: &mut HashMap<String, Instant>,
+    session_id: String,
+    now: Instant,
+) -> bool {
+    sessions.retain(|_, last_seen| now.duration_since(*last_seen) < SESSION_IDLE_TTL);
     if sessions.len() >= MAX_ACTIVE_SESSIONS {
         return false;
     }
-    sessions.insert(session_id)
+    sessions.insert(session_id, now).is_none()
 }
 
 fn remove_session(session_id: &str) -> bool {
     ACTIVE_SESSIONS
         .write()
-        .map(|mut sessions| sessions.remove(session_id))
+        .map(|mut sessions| sessions.remove(session_id).is_some())
         .unwrap_or(false)
 }
 
 fn validate_active_session(headers: &HeaderMap) -> Result<(), StatusCode> {
     let Some(session_id) = session_id(headers) else {
         return Err(StatusCode::BAD_REQUEST);
     };
-    if ACTIVE_SESSIONS
-        .read()
-        .map(|sessions| sessions.contains(session_id))
-        .unwrap_or(false)
-    {
-        Ok(())
-    } else {
-        Err(StatusCode::NOT_FOUND)
+    let Ok(mut sessions) = ACTIVE_SESSIONS.write() else {
+        return Err(StatusCode::NOT_FOUND);
+    };
+    match sessions.get_mut(session_id) {
+        Some(last_seen) => {
+            *last_seen = Instant::now();
+            Ok(())
+        }
+        None => Err(StatusCode::NOT_FOUND),
     }
 }
 
@@ -195,23 +204,42 @@ mod tests {
 
     #[test]
     fn test_session_cap_rejects_new_session_when_full() {
-        let mut sessions = HashSet::with_capacity(MAX_ACTIVE_SESSIONS);
+        let now = Instant::now();
+        let mut sessions = HashMap::with_capacity(MAX_ACTIVE_SESSIONS);
         for idx in 0..MAX_ACTIVE_SESSIONS {
             assert!(remember_session_in(
                 &mut sessions,
-                format!("test-session-{idx}")
+                format!("test-session-{idx}"),
+                now
             ));
         }
 
         assert!(!remember_session_in(
             &mut sessions,
-            "overflow-session".to_string()
+            "overflow-session".to_string(),
+            now
         ));
         assert_eq!(sessions.len(), MAX_ACTIVE_SESSIONS);
     }
 
+    #[test]
+    fn test_idle_sessions_are_evicted_on_insert() {
+        let stale_at = Instant::now();
+        let now = stale_at + SESSION_IDLE_TTL + std::time::Duration::from_secs(1);
+        let mut sessions = HashMap::new();
+        sessions.insert("stale-session".to_string(), stale_at);
+
+        assert!(remember_session_in(
+            &mut sessions,
+            "fresh-session".to_string(),
+            now
+        ));
+        assert!(!sessions.contains_key("stale-session"));
+        assert!(sessions.contains_key("fresh-session"));
+    }
+
     #[tokio::test]
-    async fn test_initialize_accepts_older_protocol_and_advertises_latest() {
+    async fn test_initialize_negotiates_supported_protocol_version() {
         let response = handler(
             HeaderMap::new(),
             axum::Json(json!({
@@ -231,7 +259,6 @@ mod tests {
         .await;
 
         assert_eq!(response.status(), StatusCode::OK);
-        assert!(response.headers().contains_key(SESSION_HEADER));
         let session_id = response
             .headers()
             .get(SESSION_HEADER)
@@ -240,7 +267,39 @@ mod tests {
             .expect("session id should be ascii")
             .to_string();
         assert!(Uuid::parse_str(&session_id).is_ok());
-        assert!(!session_id.starts_with("fast-time-"));
+        let body = response_text(response).await;
+        assert!(body.contains(r#""protocolVersion":"2024-11-05""#));
+        assert!(remove_session(&session_id));
+    }
+
+    #[tokio::test]
+    async fn test_initialize_falls_back_to_latest_for_unsupported_protocol() {
+        let response = handler(
+            HeaderMap::new(),
+            axum::Json(json!({
+                "jsonrpc": "2.0",
+                "method": "initialize",
+                "params": {
+                    "protocolVersion": "1999-01-01",
+                    "capabilities": {},
+                    "clientInfo": {
+                        "name": "go-compat-smoke",
+                        "version": "1.0"
+                    }
+                },
+                "id": 1
+            })),
+        )
+        .await;
+
+        assert_eq!(response.status(), StatusCode::OK);
+        let session_id = response
+            .headers()
+            .get(SESSION_HEADER)
+            .expect("initialize should issue session id")
+            .to_str()
+            .expect("session id should be ascii")
+            .to_string();
         let body = response_text(response).await;
         assert!(body.contains(r#""protocolVersion":"2025-11-25""#));
         assert!(remove_session(&session_id));

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-// Copyright 2025`
	`1`	`+// Copyright 2026`
`2`	`2`	`// SPDX-License-Identifier: Apache-2.0`
`3`	`3`
`4`	`4`	`use axum::Router;`