Fix work in Cline by Claude · Pull Request #12 · FalkorDB/FalkorDB-MCPServer

Claude · 2026-02-07T20:03:36Z

Original prompt

This section details on the original issue you should resolve

<issue_title>did not work in Cline</issue_title>
<issue_description>SSE error: Non-200 status code (404)
{
  "mcpServers": {
    "falkordb": {
        "disabled": false,
        "autoApprove": [],
        "timeout": 60,
        "url": "http://localhost:3000/api/sse",
        "transportType": "http"
     }
 }
}
</issue_description>

Comments on the Issue (you are @claude[agent] in this section)

Fixes did not work in Cline #3

Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>

- Create MCP server with executeQuery and listGraphs tools - Add GET /api/sse endpoint for SSE connections - Add POST /api/messages endpoint for client messages - Update documentation with SSE configuration example Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>

Copilot

Pull request overview

Adds MCP protocol support over HTTP/SSE to resolve /api/sse 404s for MCP clients (e.g., Cline) by introducing SSE transport endpoints and wiring them into the Express app.

Changes:

Implemented an MCP server with executeQuery and listGraphs tools backed by falkorDBService.
Added SSE transport endpoints (GET /api/sse, POST /api/messages) with in-memory session tracking.
Updated server routing and README docs to describe SSE-based MCP configuration.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 10 comments.

File	Description
src/services/mcp.server.ts	Introduces MCP server/tools that wrap FalkorDB operations for MCP clients.
src/routes/sse.routes.ts	Adds SSE connection endpoint and message POST endpoint with session-based transport routing.
src/index.ts	Mounts new SSE routes under `/api` (currently without auth).
README.md	Documents new SSE endpoints and provides MCP client configuration examples.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-07T20:17:10Z

+router.get('/sse', async (req: Request, res: Response) => {
+  try {
+    // Create a new SSE transport
+    const transport = new SSEServerTransport('/api/messages', res);


The message endpoint is hard-coded to /api/messages, which will break if the server is mounted under a different base path (or behind a reverse proxy path prefix). Consider deriving the endpoint from the incoming request (e.g., using req.baseUrl/req.originalUrl) so the transport advertises a correct, environment-agnostic message URL.

Suggested change

const transport = new SSEServerTransport('/api/messages', res);

const baseUrl = (req.baseUrl || '').replace(/\/$/, '');

const messagesEndpoint = `${baseUrl}/messages`;

const transport = new SSEServerTransport(messagesEndpoint, res);

Fixed in commit 2c480e4. The message endpoint is now derived from req.baseUrl to handle different base paths and reverse proxy configurations.

Copilot · 2026-02-07T20:17:10Z

+    const sessionId = req.query.sessionId as string;
+


In Express, req.query.sessionId can be string | string[] | undefined. Casting to string can cause incorrect behavior (e.g., an array becomes truthy but not a valid session key). Parse/validate the query param type explicitly (reject arrays or pick the first value) before using it as a lookup key.

Suggested change

const sessionId = req.query.sessionId as string;

const rawSessionId = req.query.sessionId;

let sessionId: string | undefined;

if (Array.isArray(rawSessionId)) {

sessionId = rawSessionId[0];

} else if (typeof rawSessionId === 'string') {

sessionId = rawSessionId;

}

Fixed in commit 2c480e4. Added explicit type checking to handle array, string, and undefined cases for the sessionId query parameter.

Copilot · 2026-02-07T20:17:11Z

+const router = Router();
+
+// Store active SSE transports by session ID
+const transports: { [sessionId: string]: SSEServerTransport } = {};


Using a plain object as a session map is more error-prone than Map (key collisions with inherited properties, less explicit APIs). Consider switching to const transports = new Map<string, SSEServerTransport>() and using set/get/delete for clearer and safer session management.

Fixed in commit 2c480e4. Replaced plain object with Map<string, SSEServerTransport> for clearer and safer session management.

Copilot · 2026-02-07T20:17:11Z

+    const sessionId = transport.sessionId;
+
+    // Store the transport
+    transports[sessionId] = transport;


Using a plain object as a session map is more error-prone than Map (key collisions with inherited properties, less explicit APIs). Consider switching to const transports = new Map<string, SSEServerTransport>() and using set/get/delete for clearer and safer session management.

Copilot · 2026-02-07T20:17:11Z

+
+    // Clean up when the connection closes
+    res.on('close', () => {
+      delete transports[sessionId];


Using a plain object as a session map is more error-prone than Map (key collisions with inherited properties, less explicit APIs). Consider switching to const transports = new Map<string, SSEServerTransport>() and using set/get/delete for clearer and safer session management.

Copilot · 2026-02-07T20:17:11Z

+      return res.status(400).json({ error: 'sessionId query parameter is required' });
+    }
+
+    const transport = transports[sessionId];


Using a plain object as a session map is more error-prone than Map (key collisions with inherited properties, less explicit APIs). Consider switching to const transports = new Map<string, SSEServerTransport>() and using set/get/delete for clearer and safer session management.

Copilot · 2026-02-07T20:17:11Z

 // Apply authentication to MCP routes
 app.use('/api/mcp', authenticateMCP, mcpRoutes);

+// SSE routes for MCP protocol (no authentication for SSE transport)
+app.use('/api', sseRoutes);


Mounting SSE MCP endpoints without authentication makes the new executeQuery tool remotely callable by anyone who can reach the server, which can expose/modify database data. If unauthenticated access is required for a specific client, consider adding an opt-in config (e.g., env flag) and/or a lightweight shared-secret check (header or query param) for /api/sse and /api/messages to reduce exposure in non-local deployments.

Suggested change

// Apply authentication to MCP routes

app.use('/api/mcp', authenticateMCP, mcpRoutes);

// SSE routes for MCP protocol (no authentication for SSE transport)

app.use('/api', sseRoutes);

// Lightweight auth for SSE MCP endpoints

const requireSseAuth = (req: any, res: any, next: any) => {

const nodeEnv = config.server.nodeEnv;

const allowUnauthenticated = process.env.ALLOW_UNAUTHENTICATED_SSE === 'true';

// Allow unauthenticated SSE only in development or when explicitly opted-in

if (nodeEnv === 'development' || allowUnauthenticated) {

return next();

}

const sharedSecret = process.env.SSE_SHARED_SECRET;

if (!sharedSecret) {

console.warn('SSE_SHARED_SECRET is not set; rejecting SSE request in non-development environment.');

return res.status(503).json({ error: 'SSE is not configured' });

}

const headerSecret = req.headers['x-sse-shared-secret'] as string | undefined;

const querySecret = (req.query && (req.query.sse_shared_secret as string | undefined)) || undefined;

const providedSecret = headerSecret || querySecret;

if (providedSecret === sharedSecret) {

return next();

}

return res.status(401).json({ error: 'Unauthorized' });

};

// Apply authentication to MCP routes

app.use('/api/mcp', authenticateMCP, mcpRoutes);

// SSE routes for MCP protocol (protected by lightweight auth)

app.use('/api', requireSseAuth, sseRoutes);

Copilot · 2026-02-07T20:17:12Z

+    {
+      graphName: z.string().describe('The name of the graph to query'),
+      query: z.string().describe('The Cypher query to execute'),
+      params: z.record(z.any()).optional().describe('Optional parameters for the query'),


Using z.any() removes meaningful validation and can mask unexpected inputs. Prefer z.unknown() (or a more specific schema if possible) for safer parsing, e.g. z.record(z.unknown()).optional().

Suggested change

params: z.record(z.any()).optional().describe('Optional parameters for the query'),

params: z.record(z.unknown()).optional().describe('Optional parameters for the query'),

Fixed in commit 2c480e4. Changed from z.any() to z.record(z.string(), z.unknown()) for safer parameter validation.

Copilot · 2026-02-07T20:17:12Z

+      } catch (error: any) {
+        return {
+          content: [
+            {
+              type: 'text',
+              text: `Error executing query: ${error.message}`,
+            },
+          ],
+          isError: true,
+        };


Returning raw error.message to the MCP client can leak sensitive internal details (DB error strings, connection info, stack-adjacent messages). Consider logging the full error server-side and returning a more generic client-facing message (optionally with a request/session correlation id).

Fixed in commit 2c480e4. Error messages now log full details server-side while returning generic messages to clients to avoid leaking sensitive database information.

Copilot · 2026-02-07T20:17:12Z

+### MCP Protocol Endpoints (SSE Transport)
+
+* `GET /api/sse`: Server-Sent Events endpoint for MCP protocol connections
+* `POST /api/messages`: Message endpoint for MCP protocol communication


The POST /api/messages endpoint requires a sessionId query parameter (as implemented in sse.routes.ts). Document the required sessionId and note that clients should use the message URL provided/constructed by the SSE handshake (rather than calling /api/messages directly without parameters).

Suggested change

* `POST /api/messages`: Message endpoint for MCP protocol communication

* `POST /api/messages?sessionId={sessionId}`: Message endpoint for MCP protocol communication. This endpoint requires a `sessionId` query parameter; clients should use the message URL provided or constructed as part of the SSE handshake rather than calling `/api/messages` directly without parameters.

Fixed in commit 2c480e4. Updated README to document that sessionId is required and clients should use the URL provided by the SSE handshake.

gkorland · 2026-02-07T22:43:00Z

@claude[agent] please review the comment in this thread

Also notice the CI is failing

- Fix server.tool() API: add description parameter and empty schema object for listGraphs - Use Map instead of plain object for session storage - Derive message endpoint from request baseUrl for flexible deployment - Validate sessionId query parameter type (handle array/string/undefined) - Change z.record param validation from z.any() to z.unknown() - Improve error handling to avoid leaking sensitive database errors - Update README to document sessionId query parameter requirement Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>

Initial plan

cf9ecdd

Claude AI assigned Claude and gkorland Feb 7, 2026

Claude started work on behalf of gkorland February 7, 2026 20:03 View session

Claude AI and others added 2 commits February 7, 2026 20:05

Initial plan for SSE endpoint implementation

b65cc8d

Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>

Claude AI changed the title ~~[WIP] Fix SSE error handling for non-200 status codes~~ Add SSE transport support for MCP protocol Feb 7, 2026

Claude AI requested a review from gkorland February 7, 2026 20:11

Claude finished work on behalf of gkorland February 7, 2026 20:11

gkorland marked this pull request as ready for review February 7, 2026 20:15

Merge branch 'main' into claude/fix-sse-error-handling

c491aa5

gkorland requested a review from Copilot February 7, 2026 20:16

Copilot AI reviewed Feb 7, 2026

View reviewed changes

Claude started work on behalf of gkorland February 7, 2026 22:43 View session

Claude AI changed the title ~~Add SSE transport support for MCP protocol~~ Addressing PR comments Feb 7, 2026

Claude finished work on behalf of gkorland February 7, 2026 22:47

gkorland changed the title ~~Addressing PR comments~~ Fix work in Cline Feb 23, 2026

-    const transport = new SSEServerTransport('/api/messages', res);
+    const baseUrl = (req.baseUrl || '').replace(/\/$/, '');
+    const messagesEndpoint = `${baseUrl}/messages`;
+    const transport = new SSEServerTransport(messagesEndpoint, res);

-    const sessionId = req.query.sessionId as string;
+    const rawSessionId = req.query.sessionId;
+    let sessionId: string | undefined;
+    if (Array.isArray(rawSessionId)) {
+      sessionId = rawSessionId[0];
+    } else if (typeof rawSessionId === 'string') {
+      sessionId = rawSessionId;
+    }

-// Apply authentication to MCP routes
-app.use('/api/mcp', authenticateMCP, mcpRoutes);
-// SSE routes for MCP protocol (no authentication for SSE transport)
-app.use('/api', sseRoutes);
+// Lightweight auth for SSE MCP endpoints
+const requireSseAuth = (req: any, res: any, next: any) => {
+  const nodeEnv = config.server.nodeEnv;
+  const allowUnauthenticated = process.env.ALLOW_UNAUTHENTICATED_SSE === 'true';
+  // Allow unauthenticated SSE only in development or when explicitly opted-in
+  if (nodeEnv === 'development' || allowUnauthenticated) {
+    return next();
+  }
+  const sharedSecret = process.env.SSE_SHARED_SECRET;
+  if (!sharedSecret) {
+    console.warn('SSE_SHARED_SECRET is not set; rejecting SSE request in non-development environment.');
+    return res.status(503).json({ error: 'SSE is not configured' });
+  }
+  const headerSecret = req.headers['x-sse-shared-secret'] as string | undefined;
+  const querySecret = (req.query && (req.query.sse_shared_secret as string | undefined)) || undefined;
+  const providedSecret = headerSecret || querySecret;
+  if (providedSecret === sharedSecret) {
+    return next();
+  }
+  return res.status(401).json({ error: 'Unauthorized' });
+};
+// Apply authentication to MCP routes
+app.use('/api/mcp', authenticateMCP, mcpRoutes);
+// SSE routes for MCP protocol (protected by lightweight auth)
+app.use('/api', requireSseAuth, sseRoutes);

	params: z.record(z.any()).optional().describe('Optional parameters for the query'),
	params: z.record(z.unknown()).optional().describe('Optional parameters for the query'),

	* `POST /api/messages`: Message endpoint for MCP protocol communication
	* `POST /api/messages?sessionId={sessionId}`: Message endpoint for MCP protocol communication. This endpoint requires a `sessionId` query parameter; clients should use the message URL provided or constructed as part of the SSE handshake rather than calling `/api/messages` directly without parameters.

Conversation

Claude AI commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Comments on the Issue (you are @claude[agent] in this section)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Claude AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Claude AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Claude AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Claude AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Claude AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Claude AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

gkorland commented Feb 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Claude AI commented Feb 7, 2026 •

edited

Loading