{"record":{"id":"3ee7632f7f62e3f1","repo":"koala73/worldmonitor","slug":"sse-connect-http-resp-status","errorCode":null,"errorMessage":"SSE connect HTTP ${resp.status}","messagePattern":"SSE connect HTTP (.+?)","errorType":"exception","errorClass":null,"httpStatus":422,"severity":"error","filePath":"api/mcp-proxy.ts","lineNumber":386,"sourceCode":"// socket-level pin available) — documented, not fixed here (P2, issue #5061).\nasync function revalidateBeforeFetch(url, signal) {\n  await assertServerUrlSafe(url, signal);\n}\n\nfunction buildInitPayload() {\n  return {\n    jsonrpc: '2.0',\n    id: 1,\n    method: 'initialize',\n    params: {\n      protocolVersion: MCP_PROTOCOL_VERSION,\n      capabilities: {},\n      clientInfo: { name: 'worldmonitor', version: '1.0' },\n    },\n  };\n}\n\nasync function validateServerUrl(raw) {\n  let url;\n  try { url = new URL(raw); } catch { return null; }\n  if (url.protocol !== 'https:') return null;\n  try {\n    return (await assertServerUrlSafe(url)).url;\n  } catch {\n    return null;\n  }\n}\n\n// Cloud-metadata gate headers (GHSA-887j, Edge-safe defence-in-depth): GCP\n// `Metadata-Flavor: Google`, Azure `Metadata: true`, AWS IMDSv2\n// `X-aws-ec2-metadata-token[-ttl-seconds]`. The proxy never forwards them, so\n// even if a DNS rebind slipped a fetch onto 169.254.169.254 the credential-less\n// request is refused by the metadata service. Matched case-insensitively. (The\n// full socket-pin fix that closes resolve!=connect is a Node-runtime follow-up;\n// this Edge mitigation kills the demonstrated PoC without a runtime switch;\n// the accepted residual and migration trade-off are tracked in issue #5061.)","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/koala73/worldmonitor/blob/e586b8b4b80f595aa7ece295eec10d76f2921240/api/mcp-proxy.ts#L368-L404","documentation":"Thrown by SseSession.connect when the initial SSE GET to the MCP server's streamable-HTTP endpoint returned a non-2xx status. The SSRF revalidation passed but the server refused the event-stream connection (auth, wrong URL, or transient upstream failure), so no SSE transport could be established.","triggerScenarios":"Thrown at api/mcp-proxy.ts:381 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the status code: 401/403 indicates missing auth headers on the SSE connection, 404 a wrong SSE endpoint URL","Confirm the server supports the legacy SSE transport, not only streamable HTTP POST","Retry transient 5xx statuses; SSE endpoints behind load balancers can fail intermittently"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e586b8b4b80f595aa7ece295eec10d76f2921240","analyzedAt":"2026-08-21T16:51:25.751Z","contentChangedAt":"2026-08-21T16:51:25.751Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}