[mariano-aguero]

Motivation and Context

Fixes #3136.

The legacy stateless fallback of createMcpHandler subscribes to request.signal only after await factory() and await product.connect(transport). An abort that fires during those awaits is never delivered to the listener added afterwards, so the request runs to completion, ctx.mcpReq.signal never aborts, and the per-request pair is only torn down when the response ends. The modern path already handles this case: PerRequestHTTPServerTransport.handleMessage checks signal.aborted and the entry answers 499.

The fallback now checks request.signal.aborted right after subscribing, tears the pair down and answers 499 with no body, as the modern path does, without dispatching the request.

How Has This Been Tested?

• Added a case to legacyStatelessFallback.test.ts that sends a request whose signal is already aborted. It asserts a 499, that the product closes and that the tool never runs. On unmodified main it fails with expected 200 to be 499, and it passes with this change.
• pnpm build:all, then pnpm --filter @modelcontextprotocol/server check (typecheck, eslint, prettier) and test (675 tests) passed.
• test/e2e passed (3126 passed, 141 expected fail, unchanged).

Breaking Changes

None. A request whose client already went away now gets 499 instead of being run. No client is left to read the answer either way.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository style guidelines
• New and existing tests pass locally
• I have added tests that prove my fix is effective
• I have checked my changes for security concerns including secrets and unsafe parsing

[changeset-bot]

🦋 Changeset detected

Latest commit: 1c92678

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3137

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3137

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3137

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3137

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3137

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3137

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3137

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3137

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3137

commit: 1c92678