apache / apache/shenyu

[BUG] MCP tool-call timeout does not cancel the in-flight plugin chain

Open
#6,889 1 comment 0 reactions 0 assignees View on GitHub
mcp priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

## Description
The CONNACK session-present flag is hard-coded `true` for every connection, including the very first connect and clients with the clean-session flag set. Combined with the complete absence of session-state persistence (`Disconnect.cleanChannel` only touches `ChannelRepository`; `Disconnect.java:39` carries `// todo Clean session`), the broker actively lies about stored session state.

## Location
- `shenyu-protocol/shenyu-protocol-mqtt/src/main/java/org/apache/shenyu/protocol/mqtt/Connect.java:72`

## Impact
Violates MQTT-3.2.2-6/7. A client reconnecting with `cleanSession=1` is told a session was present (must be `0`); a first-time client is told the same.

## Suggested fix
Set `sessionPresent` from the connect-flags `cleanSession` bit and stored session state (false when `cleanSession=1` or no prior session).

## Related existing
None.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at shenyu-protocol/shenyu-protocol-mqtt/src/main/java/org/apache/shenyu/protocol/mqtt/Connect.java:72 and inspect how the cleanSession connect flag is handled. Read Disconnect.java:39 and ChannelRepository to understand the currently missing session-state behavior. Done means sessionPresent is false for clean sessions and first connections, and true only when a prior session is actually stored.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.