koala73/worldmonitor · error

SSE connect HTTP

Error message

SSE connect HTTP ${resp.status}

What it means

Thrown by SseSession.connect when the initial SSE GET to the MCP server's streamable-HTTP endpoint returned a non-2xx status. The SSRF revalidation passed but the server refused the event-stream connection (auth, wrong URL, or transient upstream failure), so no SSE transport could be established.

Solutions

1. Check the status code: 401/403 indicates missing auth headers on the SSE connection, 404 a wrong SSE endpoint URL
2. Confirm the server supports the legacy SSE transport, not only streamable HTTP POST
3. Retry transient 5xx statuses; SSE endpoints behind load balancers can fail intermittently

When it happens

Trigger: Thrown at api/mcp-proxy.ts:381 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of koala73/worldmonitor@e586b8b4b8 (2026-08-21). Data as JSON: /api/errors/3ee7632f7f62e3f1. Report an issue: GitHub.

Appendix: source

Thrown at api/mcp-proxy.ts:386

// socket-level pin available) — documented, not fixed here (P2, issue #5061).
async function revalidateBeforeFetch(url, signal) {
  await assertServerUrlSafe(url, signal);
}

function buildInitPayload() {
  return {
    jsonrpc: '2.0',
    id: 1,
    method: 'initialize',
    params: {
      protocolVersion: MCP_PROTOCOL_VERSION,
      capabilities: {},
      clientInfo: { name: 'worldmonitor', version: '1.0' },
    },
  };
}

async function validateServerUrl(raw) {
  let url;
  try { url = new URL(raw); } catch { return null; }
  if (url.protocol !== 'https:') return null;
  try {
    return (await assertServerUrlSafe(url)).url;
  } catch {
    return null;
  }
}

// Cloud-metadata gate headers (GHSA-887j, Edge-safe defence-in-depth): GCP
// `Metadata-Flavor: Google`, Azure `Metadata: true`, AWS IMDSv2
// `X-aws-ec2-metadata-token[-ttl-seconds]`. The proxy never forwards them, so
// even if a DNS rebind slipped a fetch onto 169.254.169.254 the credential-less
// request is refused by the metadata service. Matched case-insensitively. (The
// full socket-pin fix that closes resolve!=connect is a Node-runtime follow-up;
// this Edge mitigation kills the demonstrated PoC without a runtime switch;
// the accepted residual and migration trade-off are tracked in issue #5061.)

View on GitHub (pinned to e586b8b4b8)