fix(mcp): guard nil SSE session lookup and return 400 for missing session by bandrade · Pull Request #2681 · googleapis/mcp-toolbox

bandrade · 2026-03-09T17:57:57Z

Description

Fixes a panic in SSE-backed MCP requests where POST /mcp?sessionId=... could dereference a nil session pointer in sseManager.get and return HTTP 500. The impact is failed MCP message handling after successful /mcp/sse bootstrap. The solution makes session lookup nil-safe, removes corrupt nil entries defensively, and returns HTTP 400 when a provided sessionId is unavailable.

PR Checklist

Make sure you reviewed CONTRIBUTING.md
Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
Ensure the tests and linter pass
Code coverage does not decrease (if any source code was changed)
Appropriate docs were updated (if necessary)
Make sure to add ! if this involve a breaking change

🛠️ Fixes #2680

google-cla · 2026-03-09T17:58:14Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

gemini-code-assist · 2026-03-09T17:58:20Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical bug where SSE-backed MCP requests could cause a server panic due to dereferencing a nil session pointer. The changes enhance the robustness of the SSE session management by safely handling unavailable sessions, including those that might be nil in the session map, and by providing a more appropriate HTTP 400 error response to clients when a session is not found.

Highlights

Nil Session Handling: The sseManager.get method was updated to prevent dereferencing nil session pointers, which previously led to panics. It now explicitly checks for nil session values in the map.
Error Response Improvement: The httpHandler now returns an HTTP 400 Bad Request status when a requested SSE session is not found or is unavailable, providing a clearer error to the client instead of a server-side panic.
Defensive Map Cleanup: The sseManager.get method now defensively removes any nil session entries from the sseSessions map if they are encountered, preventing future issues with corrupt entries.
Test Coverage: A new test case was added to mcp_test.go to specifically verify the correct behavior of sseManager.get when a session ID maps to a nil value.

Changelog

internal/server/mcp.go
- Modified sseManager.get to check for nil session values and remove them from the map, returning nil and false if found.
- Updated httpHandler to return an http.StatusBadRequest (400) with an error message if s.sseManager.get indicates the session is not available.
internal/server/mcp_test.go
- Added TestSseManagerGetNilSessionValue to test the new nil session handling logic in sseManager.get.

Activity

Addressed issue Bug: nil panic in SSE session lookup for /mcp requests #2680, which reported a panic in SSE-backed MCP requests.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request enhances the robustness and error handling of the SSE session management. The sseManager.get method now defensively handles cases where a session ID exists but its value is nil in the map, treating it as unavailable, removing the nil entry, and returning nil, false. Concurrently, the httpHandler is updated to properly respond with an HTTP 400 Bad Request error and terminate processing when an SSE session is not available. A new unit test, TestSseManagerGetNilSessionValue, has been added to validate this improved behavior.

Yuan325

Hi @bandrade, Thank you for identifying and fixing this! :)

Yuan325 · 2026-03-11T21:22:38Z

Hi @bandrade do you mind signing the CLA for this? Thank you!

Yuan325 · 2026-03-11T21:22:56Z

/gcbrun

bandrade · 2026-03-11T22:25:46Z

@Yuan325 Glad to contribute and they PR is useful. I just signed the CLA.

Yuan325 · 2026-03-11T22:54:08Z

/gcbrun

Yuan325 · 2026-03-11T23:00:35Z

/gcbrun

…sing session (googleapis#2681) ## Description Fixes a panic in SSE-backed MCP requests where `POST /mcp?sessionId=...` could dereference a nil session pointer in `sseManager.get` and return HTTP 500. The impact is failed MCP message handling after successful `/mcp/sse` bootstrap. The solution makes session lookup nil-safe, removes corrupt nil entries defensively, and returns HTTP 400 when a provided `sessionId` is unavailable. ## PR Checklist - [x] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/genai-toolbox/blob/main/CONTRIBUTING.md) - [x] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/genai-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [ ] Ensure the tests and linter pass - [ ] Code coverage does not decrease (if any source code was changed) - [ ] Appropriate docs were updated (if necessary) - [ ] Make sure to add `!` if this involve a breaking change 🛠️ Fixes googleapis#2680 Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> f66189f

…sion (googleapis#2681) ## Description Fixes a panic in SSE-backed MCP requests where `POST /mcp?sessionId=...` could dereference a nil session pointer in `sseManager.get` and return HTTP 500. The impact is failed MCP message handling after successful `/mcp/sse` bootstrap. The solution makes session lookup nil-safe, removes corrupt nil entries defensively, and returns HTTP 400 when a provided `sessionId` is unavailable. ## PR Checklist - [x] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/genai-toolbox/blob/main/CONTRIBUTING.md) - [x] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/genai-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [ ] Ensure the tests and linter pass - [ ] Code coverage does not decrease (if any source code was changed) - [ ] Appropriate docs were updated (if necessary) - [ ] Make sure to add `!` if this involve a breaking change 🛠️ Fixes googleapis#2680 Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.29.0](v0.28.0...v0.29.0) (2026-03-13) ### ⚠ BREAKING CHANGES * **source/alloydb:** restructure prebuilt toolsets ([#2639](#2639)) * **source/spanner:** restructure prebuilt toolsets ([#2641](#2641)) * **source/dataplex:** restructure prebuilt toolsets ([#2640](#2640)) * **source/oss-db:** restructure prebuilt toolsets ([#2638](#2638)) * **source/cloudsql:** restructure prebuilt toolsets ([#2635](#2635)) * **source/bigquery:** restructure prebuilt toolsets ([#2637](#2637)) * **source/firestore:** restructure prebuilt toolsets ([#2636](#2636)) * telemetry metrics updates as per semantic convention ([#2566](#2566)) ### Features * Add user agent to embeddings generation ([#2572](#2572)) ([287251a](287251a)) * **skill:** Attach user agent metadata for generated skill ([#2697](#2697)) ([9598a6a](9598a6a)) * **skills:** Add additional-notes flag to generate skills command ([#2696](#2696)) ([73bf962](73bf962)) * **skill:** Update skill generation logic ([#2646](#2646)) ([c233eee](c233eee)) * **source/alloydb:** Restructure prebuilt toolsets ([#2639](#2639)) ([5f3f063](5f3f063)) * **source/bigquery:** Restructure prebuilt toolsets ([#2637](#2637)) ([dc984ba](dc984ba)) * **sources/bigquery:** Support custom oauth header name ([#2564](#2564)) ([d3baf77](d3baf77)) * **source/cloudsql:** Restructure prebuilt toolsets ([#2635](#2635)) ([99613dc](99613dc)) * **source/dataplex:** Restructure prebuilt toolsets ([#2640](#2640)) ([acb9a80](acb9a80)) * **source/firestore:** Restructure prebuilt toolsets ([#2636](#2636)) ([22ab7b9](22ab7b9)) * **source/oss-db:** Restructure prebuilt toolsets ([#2638](#2638)) ([5196c6a](5196c6a)) * **source/spanner:** Restructure prebuilt toolsets ([#2641](#2641)) ([ea2b698](ea2b698)) * Telemetry metrics updates as per semantic convention ([#2566](#2566)) ([131d764](131d764)) * **tools/mongodb:** Add tool annotations to MongoDB tools for improved LLM understanding ([#2219](#2219)) ([b7a5f80](b7a5f80)) * **tools/serverless-spark:** Add get_session_template tool ([#2308](#2308)) ([a136e16](a136e16)) * **tools/serverless-spark:** Add list/get sessions tools ([#2576](#2576)) ([a554298](a554298)) ### Bug Fixes * Improve list locks integration test for postgres ([#2279](#2279)) ([d9ebe5d](d9ebe5d)) * **mcp:** Guard nil SSE session lookup and return 400 for missing session ([#2681](#2681)) ([f66189f](f66189f)) * **oracle:** Update oracle-execute-sql tool interface to match source signature ([#2627](#2627)) ([81699a3](81699a3)) * Return AllParams for GetParameter() for tools with templateParameter([#2734](#2734)) ([bfd7ba6](bfd7ba6)) * **server/mcp:** Scope defer span.End inside loop iteration ([#2558](#2558)) ([c88a62d](c88a62d)), closes [#2549](#2549) * **skill:** Fix env variable propagation ([#2645](#2645)) ([5271368](5271368)) * **sources/looker:** Looker and looker-dev prebuilt tools should share one source definition. ([#2620](#2620)) ([df7f2fd](df7f2fd)) * **telemetry:** Histogram buckets from OTel standard to MCP standards ([#2729](#2729)) ([87cd4a0](87cd4a0)) * **ui:** Remove module from script ([#2703](#2703)) ([6943ab6](6943ab6)) * Update toolset attributes naming ([#2554](#2554)) ([3d6ae4e](3d6ae4e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.29.0](v0.28.0...v0.29.0) (2026-03-13) ### ⚠ BREAKING CHANGES * **source/alloydb:** restructure prebuilt toolsets ([#2639](#2639)) * **source/spanner:** restructure prebuilt toolsets ([#2641](#2641)) * **source/dataplex:** restructure prebuilt toolsets ([#2640](#2640)) * **source/oss-db:** restructure prebuilt toolsets ([#2638](#2638)) * **source/cloudsql:** restructure prebuilt toolsets ([#2635](#2635)) * **source/bigquery:** restructure prebuilt toolsets ([#2637](#2637)) * **source/firestore:** restructure prebuilt toolsets ([#2636](#2636)) * telemetry metrics updates as per semantic convention ([#2566](#2566)) ### Features * Add user agent to embeddings generation ([#2572](#2572)) ([287251a](287251a)) * **skill:** Attach user agent metadata for generated skill ([#2697](#2697)) ([9598a6a](9598a6a)) * **skills:** Add additional-notes flag to generate skills command ([#2696](#2696)) ([73bf962](73bf962)) * **skill:** Update skill generation logic ([#2646](#2646)) ([c233eee](c233eee)) * **source/alloydb:** Restructure prebuilt toolsets ([#2639](#2639)) ([5f3f063](5f3f063)) * **source/bigquery:** Restructure prebuilt toolsets ([#2637](#2637)) ([dc984ba](dc984ba)) * **sources/bigquery:** Support custom oauth header name ([#2564](#2564)) ([d3baf77](d3baf77)) * **source/cloudsql:** Restructure prebuilt toolsets ([#2635](#2635)) ([99613dc](99613dc)) * **source/dataplex:** Restructure prebuilt toolsets ([#2640](#2640)) ([acb9a80](acb9a80)) * **source/firestore:** Restructure prebuilt toolsets ([#2636](#2636)) ([22ab7b9](22ab7b9)) * **source/oss-db:** Restructure prebuilt toolsets ([#2638](#2638)) ([5196c6a](5196c6a)) * **source/spanner:** Restructure prebuilt toolsets ([#2641](#2641)) ([ea2b698](ea2b698)) * Telemetry metrics updates as per semantic convention ([#2566](#2566)) ([131d764](131d764)) * **tools/mongodb:** Add tool annotations to MongoDB tools for improved LLM understanding ([#2219](#2219)) ([b7a5f80](b7a5f80)) * **tools/serverless-spark:** Add get_session_template tool ([#2308](#2308)) ([a136e16](a136e16)) * **tools/serverless-spark:** Add list/get sessions tools ([#2576](#2576)) ([a554298](a554298)) ### Bug Fixes * Improve list locks integration test for postgres ([#2279](#2279)) ([d9ebe5d](d9ebe5d)) * **mcp:** Guard nil SSE session lookup and return 400 for missing session ([#2681](#2681)) ([f66189f](f66189f)) * **oracle:** Update oracle-execute-sql tool interface to match source signature ([#2627](#2627)) ([81699a3](81699a3)) * Return AllParams for GetParameter() for tools with templateParameter([#2734](#2734)) ([bfd7ba6](bfd7ba6)) * **server/mcp:** Scope defer span.End inside loop iteration ([#2558](#2558)) ([c88a62d](c88a62d)), closes [#2549](#2549) * **skill:** Fix env variable propagation ([#2645](#2645)) ([5271368](5271368)) * **sources/looker:** Looker and looker-dev prebuilt tools should share one source definition. ([#2620](#2620)) ([df7f2fd](df7f2fd)) * **telemetry:** Histogram buckets from OTel standard to MCP standards ([#2729](#2729)) ([87cd4a0](87cd4a0)) * **ui:** Remove module from script ([#2703](#2703)) ([6943ab6](6943ab6)) * Update toolset attributes naming ([#2554](#2554)) ([3d6ae4e](3d6ae4e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> 39832a0

🤖 I have created a release *beep* *boop* --- ## [0.29.0](googleapis/mcp-toolbox@v0.28.0...v0.29.0) (2026-03-13) ### ⚠ BREAKING CHANGES * **source/alloydb:** restructure prebuilt toolsets ([googleapis#2639](googleapis#2639)) * **source/spanner:** restructure prebuilt toolsets ([googleapis#2641](googleapis#2641)) * **source/dataplex:** restructure prebuilt toolsets ([googleapis#2640](googleapis#2640)) * **source/oss-db:** restructure prebuilt toolsets ([googleapis#2638](googleapis#2638)) * **source/cloudsql:** restructure prebuilt toolsets ([googleapis#2635](googleapis#2635)) * **source/bigquery:** restructure prebuilt toolsets ([googleapis#2637](googleapis#2637)) * **source/firestore:** restructure prebuilt toolsets ([googleapis#2636](googleapis#2636)) * telemetry metrics updates as per semantic convention ([googleapis#2566](googleapis#2566)) ### Features * Add user agent to embeddings generation ([googleapis#2572](googleapis#2572)) ([287251a](googleapis@287251a)) * **skill:** Attach user agent metadata for generated skill ([googleapis#2697](googleapis#2697)) ([9598a6a](googleapis@9598a6a)) * **skills:** Add additional-notes flag to generate skills command ([googleapis#2696](googleapis#2696)) ([73bf962](googleapis@73bf962)) * **skill:** Update skill generation logic ([googleapis#2646](googleapis#2646)) ([c233eee](googleapis@c233eee)) * **source/alloydb:** Restructure prebuilt toolsets ([googleapis#2639](googleapis#2639)) ([5f3f063](googleapis@5f3f063)) * **source/bigquery:** Restructure prebuilt toolsets ([googleapis#2637](googleapis#2637)) ([dc984ba](googleapis@dc984ba)) * **sources/bigquery:** Support custom oauth header name ([googleapis#2564](googleapis#2564)) ([d3baf77](googleapis@d3baf77)) * **source/cloudsql:** Restructure prebuilt toolsets ([googleapis#2635](googleapis#2635)) ([99613dc](googleapis@99613dc)) * **source/dataplex:** Restructure prebuilt toolsets ([googleapis#2640](googleapis#2640)) ([acb9a80](googleapis@acb9a80)) * **source/firestore:** Restructure prebuilt toolsets ([googleapis#2636](googleapis#2636)) ([22ab7b9](googleapis@22ab7b9)) * **source/oss-db:** Restructure prebuilt toolsets ([googleapis#2638](googleapis#2638)) ([5196c6a](googleapis@5196c6a)) * **source/spanner:** Restructure prebuilt toolsets ([googleapis#2641](googleapis#2641)) ([ea2b698](googleapis@ea2b698)) * Telemetry metrics updates as per semantic convention ([googleapis#2566](googleapis#2566)) ([131d764](googleapis@131d764)) * **tools/mongodb:** Add tool annotations to MongoDB tools for improved LLM understanding ([googleapis#2219](googleapis#2219)) ([b7a5f80](googleapis@b7a5f80)) * **tools/serverless-spark:** Add get_session_template tool ([googleapis#2308](googleapis#2308)) ([a136e16](googleapis@a136e16)) * **tools/serverless-spark:** Add list/get sessions tools ([googleapis#2576](googleapis#2576)) ([a554298](googleapis@a554298)) ### Bug Fixes * Improve list locks integration test for postgres ([googleapis#2279](googleapis#2279)) ([d9ebe5d](googleapis@d9ebe5d)) * **mcp:** Guard nil SSE session lookup and return 400 for missing session ([googleapis#2681](googleapis#2681)) ([f66189f](googleapis@f66189f)) * **oracle:** Update oracle-execute-sql tool interface to match source signature ([googleapis#2627](googleapis#2627)) ([81699a3](googleapis@81699a3)) * Return AllParams for GetParameter() for tools with templateParameter([googleapis#2734](googleapis#2734)) ([bfd7ba6](googleapis@bfd7ba6)) * **server/mcp:** Scope defer span.End inside loop iteration ([googleapis#2558](googleapis#2558)) ([c88a62d](googleapis@c88a62d)), closes [googleapis#2549](googleapis#2549) * **skill:** Fix env variable propagation ([googleapis#2645](googleapis#2645)) ([5271368](googleapis@5271368)) * **sources/looker:** Looker and looker-dev prebuilt tools should share one source definition. ([googleapis#2620](googleapis#2620)) ([df7f2fd](googleapis@df7f2fd)) * **telemetry:** Histogram buckets from OTel standard to MCP standards ([googleapis#2729](googleapis#2729)) ([87cd4a0](googleapis@87cd4a0)) * **ui:** Remove module from script ([googleapis#2703](googleapis#2703)) ([6943ab6](googleapis@6943ab6)) * Update toolset attributes naming ([googleapis#2554](googleapis#2554)) ([3d6ae4e](googleapis@3d6ae4e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> 39832a0

🤖 I have created a release *beep* *boop* --- ## [0.29.0](googleapis/mcp-toolbox@v0.28.0...v0.29.0) (2026-03-13) ### ⚠ BREAKING CHANGES * **source/alloydb:** restructure prebuilt toolsets ([#2639](googleapis/mcp-toolbox#2639)) * **source/spanner:** restructure prebuilt toolsets ([#2641](googleapis/mcp-toolbox#2641)) * **source/dataplex:** restructure prebuilt toolsets ([#2640](googleapis/mcp-toolbox#2640)) * **source/oss-db:** restructure prebuilt toolsets ([#2638](googleapis/mcp-toolbox#2638)) * **source/cloudsql:** restructure prebuilt toolsets ([#2635](googleapis/mcp-toolbox#2635)) * **source/bigquery:** restructure prebuilt toolsets ([#2637](googleapis/mcp-toolbox#2637)) * **source/firestore:** restructure prebuilt toolsets ([#2636](googleapis/mcp-toolbox#2636)) * telemetry metrics updates as per semantic convention ([#2566](googleapis/mcp-toolbox#2566)) ### Features * Add user agent to embeddings generation ([#2572](googleapis/mcp-toolbox#2572)) ([287251a](googleapis/mcp-toolbox@287251a)) * **skill:** Attach user agent metadata for generated skill ([#2697](googleapis/mcp-toolbox#2697)) ([9598a6a](googleapis/mcp-toolbox@9598a6a)) * **skills:** Add additional-notes flag to generate skills command ([#2696](googleapis/mcp-toolbox#2696)) ([73bf962](googleapis/mcp-toolbox@73bf962)) * **skill:** Update skill generation logic ([#2646](googleapis/mcp-toolbox#2646)) ([c233eee](googleapis/mcp-toolbox@c233eee)) * **source/alloydb:** Restructure prebuilt toolsets ([#2639](googleapis/mcp-toolbox#2639)) ([5f3f063](googleapis/mcp-toolbox@5f3f063)) * **source/bigquery:** Restructure prebuilt toolsets ([#2637](googleapis/mcp-toolbox#2637)) ([dc984ba](googleapis/mcp-toolbox@dc984ba)) * **sources/bigquery:** Support custom oauth header name ([#2564](googleapis/mcp-toolbox#2564)) ([d3baf77](googleapis/mcp-toolbox@d3baf77)) * **source/cloudsql:** Restructure prebuilt toolsets ([#2635](googleapis/mcp-toolbox#2635)) ([99613dc](googleapis/mcp-toolbox@99613dc)) * **source/dataplex:** Restructure prebuilt toolsets ([#2640](googleapis/mcp-toolbox#2640)) ([acb9a80](googleapis/mcp-toolbox@acb9a80)) * **source/firestore:** Restructure prebuilt toolsets ([#2636](googleapis/mcp-toolbox#2636)) ([22ab7b9](googleapis/mcp-toolbox@22ab7b9)) * **source/oss-db:** Restructure prebuilt toolsets ([#2638](googleapis/mcp-toolbox#2638)) ([5196c6a](googleapis/mcp-toolbox@5196c6a)) * **source/spanner:** Restructure prebuilt toolsets ([#2641](googleapis/mcp-toolbox#2641)) ([ea2b698](googleapis/mcp-toolbox@ea2b698)) * Telemetry metrics updates as per semantic convention ([#2566](googleapis/mcp-toolbox#2566)) ([131d764](googleapis/mcp-toolbox@131d764)) * **tools/mongodb:** Add tool annotations to MongoDB tools for improved LLM understanding ([#2219](googleapis/mcp-toolbox#2219)) ([b7a5f80](googleapis/mcp-toolbox@b7a5f80)) * **tools/serverless-spark:** Add get_session_template tool ([#2308](googleapis/mcp-toolbox#2308)) ([a136e16](googleapis/mcp-toolbox@a136e16)) * **tools/serverless-spark:** Add list/get sessions tools ([#2576](googleapis/mcp-toolbox#2576)) ([a554298](googleapis/mcp-toolbox@a554298)) ### Bug Fixes * Improve list locks integration test for postgres ([#2279](googleapis/mcp-toolbox#2279)) ([d9ebe5d](googleapis/mcp-toolbox@d9ebe5d)) * **mcp:** Guard nil SSE session lookup and return 400 for missing session ([#2681](googleapis/mcp-toolbox#2681)) ([f66189f](googleapis/mcp-toolbox@f66189f)) * **oracle:** Update oracle-execute-sql tool interface to match source signature ([#2627](googleapis/mcp-toolbox#2627)) ([81699a3](googleapis/mcp-toolbox@81699a3)) * Return AllParams for GetParameter() for tools with templateParameter([#2734](googleapis/mcp-toolbox#2734)) ([bfd7ba6](googleapis/mcp-toolbox@bfd7ba6)) * **server/mcp:** Scope defer span.End inside loop iteration ([#2558](googleapis/mcp-toolbox#2558)) ([c88a62d](googleapis/mcp-toolbox@c88a62d)), closes [#2549](googleapis/mcp-toolbox#2549) * **skill:** Fix env variable propagation ([#2645](googleapis/mcp-toolbox#2645)) ([5271368](googleapis/mcp-toolbox@5271368)) * **sources/looker:** Looker and looker-dev prebuilt tools should share one source definition. ([#2620](googleapis/mcp-toolbox#2620)) ([df7f2fd](googleapis/mcp-toolbox@df7f2fd)) * **telemetry:** Histogram buckets from OTel standard to MCP standards ([#2729](googleapis/mcp-toolbox#2729)) ([87cd4a0](googleapis/mcp-toolbox@87cd4a0)) * **ui:** Remove module from script ([#2703](googleapis/mcp-toolbox#2703)) ([6943ab6](googleapis/mcp-toolbox@6943ab6)) * Update toolset attributes naming ([#2554](googleapis/mcp-toolbox#2554)) ([3d6ae4e](googleapis/mcp-toolbox@3d6ae4e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

…sion (googleapis#2681) ## Description Fixes a panic in SSE-backed MCP requests where `POST /mcp?sessionId=...` could dereference a nil session pointer in `sseManager.get` and return HTTP 500. The impact is failed MCP message handling after successful `/mcp/sse` bootstrap. The solution makes session lookup nil-safe, removes corrupt nil entries defensively, and returns HTTP 400 when a provided `sessionId` is unavailable. ## PR Checklist - [x] Make sure you reviewed [CONTRIBUTING.md](https://github.com/googleapis/genai-toolbox/blob/main/CONTRIBUTING.md) - [x] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/genai-toolbox/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea - [ ] Ensure the tests and linter pass - [ ] Code coverage does not decrease (if any source code was changed) - [ ] Appropriate docs were updated (if necessary) - [ ] Make sure to add `!` if this involve a breaking change 🛠️ Fixes googleapis#2680 Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.29.0](googleapis/mcp-toolbox@v0.28.0...v0.29.0) (2026-03-13) ### ⚠ BREAKING CHANGES * **source/alloydb:** restructure prebuilt toolsets ([googleapis#2639](googleapis#2639)) * **source/spanner:** restructure prebuilt toolsets ([googleapis#2641](googleapis#2641)) * **source/dataplex:** restructure prebuilt toolsets ([googleapis#2640](googleapis#2640)) * **source/oss-db:** restructure prebuilt toolsets ([googleapis#2638](googleapis#2638)) * **source/cloudsql:** restructure prebuilt toolsets ([googleapis#2635](googleapis#2635)) * **source/bigquery:** restructure prebuilt toolsets ([googleapis#2637](googleapis#2637)) * **source/firestore:** restructure prebuilt toolsets ([googleapis#2636](googleapis#2636)) * telemetry metrics updates as per semantic convention ([googleapis#2566](googleapis#2566)) ### Features * Add user agent to embeddings generation ([googleapis#2572](googleapis#2572)) ([287251a](googleapis@287251a)) * **skill:** Attach user agent metadata for generated skill ([googleapis#2697](googleapis#2697)) ([9598a6a](googleapis@9598a6a)) * **skills:** Add additional-notes flag to generate skills command ([googleapis#2696](googleapis#2696)) ([73bf962](googleapis@73bf962)) * **skill:** Update skill generation logic ([googleapis#2646](googleapis#2646)) ([c233eee](googleapis@c233eee)) * **source/alloydb:** Restructure prebuilt toolsets ([googleapis#2639](googleapis#2639)) ([5f3f063](googleapis@5f3f063)) * **source/bigquery:** Restructure prebuilt toolsets ([googleapis#2637](googleapis#2637)) ([dc984ba](googleapis@dc984ba)) * **sources/bigquery:** Support custom oauth header name ([googleapis#2564](googleapis#2564)) ([d3baf77](googleapis@d3baf77)) * **source/cloudsql:** Restructure prebuilt toolsets ([googleapis#2635](googleapis#2635)) ([99613dc](googleapis@99613dc)) * **source/dataplex:** Restructure prebuilt toolsets ([googleapis#2640](googleapis#2640)) ([acb9a80](googleapis@acb9a80)) * **source/firestore:** Restructure prebuilt toolsets ([googleapis#2636](googleapis#2636)) ([22ab7b9](googleapis@22ab7b9)) * **source/oss-db:** Restructure prebuilt toolsets ([googleapis#2638](googleapis#2638)) ([5196c6a](googleapis@5196c6a)) * **source/spanner:** Restructure prebuilt toolsets ([googleapis#2641](googleapis#2641)) ([ea2b698](googleapis@ea2b698)) * Telemetry metrics updates as per semantic convention ([googleapis#2566](googleapis#2566)) ([131d764](googleapis@131d764)) * **tools/mongodb:** Add tool annotations to MongoDB tools for improved LLM understanding ([googleapis#2219](googleapis#2219)) ([b7a5f80](googleapis@b7a5f80)) * **tools/serverless-spark:** Add get_session_template tool ([googleapis#2308](googleapis#2308)) ([a136e16](googleapis@a136e16)) * **tools/serverless-spark:** Add list/get sessions tools ([googleapis#2576](googleapis#2576)) ([a554298](googleapis@a554298)) ### Bug Fixes * Improve list locks integration test for postgres ([googleapis#2279](googleapis#2279)) ([d9ebe5d](googleapis@d9ebe5d)) * **mcp:** Guard nil SSE session lookup and return 400 for missing session ([googleapis#2681](googleapis#2681)) ([f66189f](googleapis@f66189f)) * **oracle:** Update oracle-execute-sql tool interface to match source signature ([googleapis#2627](googleapis#2627)) ([81699a3](googleapis@81699a3)) * Return AllParams for GetParameter() for tools with templateParameter([googleapis#2734](googleapis#2734)) ([bfd7ba6](googleapis@bfd7ba6)) * **server/mcp:** Scope defer span.End inside loop iteration ([googleapis#2558](googleapis#2558)) ([c88a62d](googleapis@c88a62d)), closes [googleapis#2549](googleapis#2549) * **skill:** Fix env variable propagation ([googleapis#2645](googleapis#2645)) ([5271368](googleapis@5271368)) * **sources/looker:** Looker and looker-dev prebuilt tools should share one source definition. ([googleapis#2620](googleapis#2620)) ([df7f2fd](googleapis@df7f2fd)) * **telemetry:** Histogram buckets from OTel standard to MCP standards ([googleapis#2729](googleapis#2729)) ([87cd4a0](googleapis@87cd4a0)) * **ui:** Remove module from script ([googleapis#2703](googleapis#2703)) ([6943ab6](googleapis@6943ab6)) * Update toolset attributes naming ([googleapis#2554](googleapis#2554)) ([3d6ae4e](googleapis@3d6ae4e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

fix(mcp): guard nil SSE sessions and return 400 for missing session

c68813f

bandrade requested a review from a team as a code owner March 9, 2026 17:57

blunderbuss-gcf bot assigned duwenxin99 Mar 9, 2026

gemini-code-assist bot reviewed Mar 9, 2026

View reviewed changes

Yuan325 approved these changes Mar 11, 2026

View reviewed changes

Yuan325 assigned Yuan325 and unassigned duwenxin99 Mar 11, 2026

Yuan325 added the release candidate Use label to signal PR should be included in the next release. label Mar 11, 2026

Merge branch 'main' into fix/mcp-session-nil-guard

a380316

Merge branch 'main' into fix/mcp-session-nil-guard

c7a1bc6

Merge branch 'main' into fix/mcp-session-nil-guard

2af929d

Yuan325 added the tests: run Label to trigger Github Action tests. label Mar 11, 2026

Yuan325 enabled auto-merge (squash) March 11, 2026 23:26

Yuan325 merged commit f66189f into googleapis:main Mar 11, 2026
15 checks passed

release-please bot mentioned this pull request Mar 11, 2026

chore(main): release 0.29.0 #2608

Merged

BrewTestBot mentioned this pull request Mar 13, 2026

mcp-toolbox 0.29.0 Homebrew/homebrew-core#272217

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(mcp): guard nil SSE session lookup and return 400 for missing session#2681

fix(mcp): guard nil SSE session lookup and return 400 for missing session#2681
Yuan325 merged 4 commits intogoogleapis:mainfrom
bandrade:fix/mcp-session-nil-guard

bandrade commented Mar 9, 2026 •

edited

Loading

Uh oh!

google-cla bot commented Mar 9, 2026

Uh oh!

gemini-code-assist bot commented Mar 9, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Yuan325 left a comment

Uh oh!

Yuan325 commented Mar 11, 2026

Uh oh!

Yuan325 commented Mar 11, 2026

Uh oh!

bandrade commented Mar 11, 2026

Uh oh!

Yuan325 commented Mar 11, 2026

Uh oh!

Yuan325 commented Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bandrade commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

PR Checklist

Uh oh!

google-cla bot commented Mar 9, 2026

Uh oh!

gemini-code-assist bot commented Mar 9, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Yuan325 left a comment

Choose a reason for hiding this comment

Uh oh!

Yuan325 commented Mar 11, 2026

Uh oh!

Yuan325 commented Mar 11, 2026

Uh oh!

bandrade commented Mar 11, 2026

Uh oh!

Yuan325 commented Mar 11, 2026

Uh oh!

Yuan325 commented Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bandrade commented Mar 9, 2026 •

edited

Loading