[compliance] Compliance Gap: /close Endpoint Missing In-Flight Request Completion & SHOULD Violations

[github-actions]

MCP Gateway Compliance Review - 2026-02-23

Summary

Found 1 critical (MUST violation) and 5 important (SHOULD violations) during daily review of commit be3b856.

Recent Changes Reviewed

• Commit be3b856: Recompile language-support-tester workflow with latest compiler (Recompile language-support-tester workflow with latest compiler #1314)
• Only one commit in grafted repository; full codebase reviewed against MCP Gateway Specification v1.8.0

Critical Issues (MUST violations)

1. /close Endpoint Does Not Complete In-Flight Requests Before Terminating Containers

Specification Section: 5.1.3 Close Endpoint Behavior
Deep Link: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#513-close-endpoint-behavior

Requirement:

"The gateway MUST perform the following actions when the /close endpoint is called:
2. Complete In-Flight Requests: Allow currently processing requests to complete (with a reasonable timeout, e.g., 30 seconds)
3. Terminate All Containers: Stop all running MCP server containers..."

Current State:
In internal/server/handlers.go:59, handleClose calls unifiedServer.InitiateShutdown() which:

1. Sets isShutdown = true (correctly rejects new requests)
2. Immediately calls us.launcher.Close() (terminates backend containers)

After returning the 200 response, os.Exit(0) is triggered after only 100ms (internal/server/handlers.go:76-80).

There is no sync.WaitGroup or any mechanism to track in-flight requests. Searching for in-flight, inflight, ActiveRequests, or WaitForInFlight in internal/server/ returns no results.

Contrast with SIGTERM path: When the process receives SIGTERM, internal/cmd/root.go:319 calls httpServer.Shutdown(shutdownCtx) with a 5-second graceful shutdown that waits for active HTTP connections. The /close endpoint bypasses this mechanism entirely.

Gap:

• In-flight requests to /mcp/{server-name} may be mid-flight when backend containers are terminated, causing those requests to fail with connection errors rather than completing normally.
• The 100ms exit delay is arbitrary and not tied to request completion.
• The spec mandates a 30-second completion window; the implementation provides 100ms before process exit.

Severity: Critical (MUST violation)

File References:

• internal/server/handlers.go:55-82 (handleClose implementation)
• internal/server/unified.go:989-1015 (InitiateShutdown - no in-flight tracking)
• internal/cmd/root.go:315-323 (SIGTERM path correctly uses httpServer.Shutdown)

Suggested Fix:
Add an active request counter (e.g., using sync/atomic or middleware sync.WaitGroup) that tracks in-flight requests to /mcp/{server-name}. In InitiateShutdown, after setting isShutdown = true, wait for the counter to reach zero (or until a 30-second timeout) before calling us.launcher.Close(). Alternatively, trigger httpServer.Shutdown(ctx) from the close handler before exiting.

---

Important Issues (SHOULD violations)

2. No Periodic Health Checks or Automatic Container Restart

Specification Section: 8.2 Health Check Behavior
Deep Link: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#82-health-check-behavior

Requirement:

"The gateway SHOULD:

1. Periodically check server health (every 30 seconds)
2. Restart failed containerized stdio servers automatically"

Current State: No background goroutine exists that periodically checks server health or restarts failed containers. internal/server/unified.go has no ticker or health-monitor goroutine. The /health endpoint reports current status but does not drive any proactive monitoring.

Severity: Important (SHOULD violation)

File References:

• internal/server/unified.go (no health monitor goroutine)
• internal/server/health.go (reactive only, no proactive monitoring)

---

3. No TLS/HTTPS Support

Specification Section: Appendix D.2 Network Security
Deep Link: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#d2-network-security

Requirement:

"Gateway SHOULD support TLS/HTTPS"

Current State: The gateway only supports plain HTTP (http.ListenAndServe). There is no --tls-cert / --tls-key flag or TLS configuration support in internal/cmd/root.go.

Severity: Important (SHOULD violation)

File References:

• internal/cmd/root.go:302 (httpServer.ListenAndServe() — no TLS variant)

---

4. No Cross-Origin Request Restrictions

Specification Section: Appendix D.2 Network Security
Deep Link: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#d2-network-security

Requirement:

"Cross-origin requests SHOULD be restricted"

Current State: No CORS headers or origin validation middleware found in internal/server/. The gateway accepts requests from any origin.

Severity: Important (SHOULD violation)

---

5. No Rate Limiting

Specification Section: Appendix D.2 Network Security
Deep Link: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#d2-network-security

Requirement:

"Rate limiting SHOULD be implemented"

Current State: No rate limiting middleware found in internal/server/ or internal/middleware/.

Severity: Important (SHOULD violation)

---

6. Container Resource Limits Not Enforced

Specification Section: Appendix D.3 Container Security
Deep Link: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#d3-container-security

Requirement:

"Resource limits SHOULD be enforced (CPU, memory, file descriptors)"

Current State: Docker containers are launched without --memory, --cpus, or --ulimit flags. No resource constraint configuration exists in internal/launcher/.

Severity: Important (SHOULD violation)

---

Suggested Remediation Tasks

Task 1: Fix In-Flight Request Tracking for /close Endpoint (Critical)

Description: Add middleware to count active in-flight requests. Modify InitiateShutdown to wait (up to 30s) for in-flight count to reach 0 before calling us.launcher.Close(). Update the 100ms exit delay to respect in-flight completion.
Files: internal/server/unified.go, internal/server/handlers.go, internal/server/http_helpers.go
Specification Reference: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#513-close-endpoint-behavior
Estimated Effort: Medium (4-6 hours)

Task 2: Implement Periodic Health Monitoring & Container Auto-Restart

Description: Add a background goroutine in UnifiedServer that ticks every 30 seconds, checks container health via the launcher, and restarts failed containers.
Files: internal/server/unified.go, internal/launcher/launcher.go
Specification Reference: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#82-health-check-behavior
Estimated Effort: Medium (6-8 hours)

Task 3: Add TLS/HTTPS Support

Description: Add --tls-cert and --tls-key CLI flags. Use http.ListenAndServeTLS when cert/key are provided.
Files: internal/cmd/root.go
Specification Reference: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#d2-network-security
Estimated Effort: Small (2-4 hours)

---

Compliance Status

• ✅ Configuration Format (Section 4.1): Compliant
• ✅ Variable Expansion (Section 4.2): Compliant
• ✅ Configuration Validation (Section 4.3): Compliant
• ✅ Containerization Requirement (Section 3.2.1): Compliant
• ✅ Custom Server Types (Section 4.1.4): Compliant
• ✅ Volume Mounts (Section 4.1.5): Compliant
• ✅ Protocol Translation (Section 5.2): Compliant
• ✅ HTTP Connection Failure Handling (Section 5.2.2): Compliant
• ❌ Close Endpoint In-Flight Requests (Section 5.1.3): Non-compliant (MUST violation)
• ✅ Stdout Configuration Output (Section 5.4): Compliant
• ✅ Container Isolation (Section 6.1): Compliant
• ✅ Authentication (Section 7): Compliant
• ✅ Health Endpoint Format (Section 8.1): Compliant
• ⚠️ Health Monitoring Behavior (Section 8.2): Partial (SHOULD violations)
• ✅ Error Handling (Section 9): Compliant

References

• MCP Gateway Specification v1.8.0
• Commits reviewed: be3b856 (single grafted commit)
• Review date: 2026-02-23

Generated by Daily Compliance Checker

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster