From 0ecfe74477a019820438cf92bd18573fc54f9750 Mon Sep 17 00:00:00 2001
From: Yician Wang <yulin0629@users.noreply.github.com>
Date: Tue, 15 Sep 2026 06:57:02 +0000
Subject: [PATCH] fix(mcp): settle the /mcp auth wait when bearer auth writes
 the response

requireBearerAuth answers 401/403 itself and never calls next(), so the
Promise wrapping it in the /mcp handler never settled on auth failure and
kept req/res reachable for the life of the process. Resolve on the
response's finish/close as well, so a rejected request releases its
handler continuation.
---
 src/server.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/server.ts b/src/server.ts
index 608498a45..2a7e6cdea 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -926,6 +926,8 @@ export function createServer(
     const requestId = res.locals.requestId as string | undefined;
 
     await new Promise<void>((resolve, reject) => {
+      res.once("finish", resolve);
+      res.once("close", resolve);
       bearerAuth(req, res, (error?: unknown) => {
         if (error) reject(error);
         else resolve();