AI-written code reused a shared session-state token across clients in stateless mode, allowing cross-client session data exposure.

++import (+	"github.com/mark3labs/mcp-go/mcp"+	"testing"++	"github.com/mark3labs/mcp-go/server"+	log "github.com/sirupsen/logrus"+	"github.com/stretchr/testify/assert"+)++func TestRegisterTools(t *testing.T) {+	// Create a mock MCP server+	mcpServer := &mockMCPServer{+		tools: make(map[string]server.ServerTool),+	}++	// Test tool registration+	RegisterTools(mcpServer, log.New())++	// Verify that tools were registered+	assert.Greater(t, len(mcpServer.tools), 0, "Expected tools to be registered")++	// Check for some expected tools+	expectedTools := []string{+		"catalog_services",+		"catalog_nodes",+		"health_service",+		"kv_get",+		"acl_tokens",+	}++	for _, toolName := range expectedTools {+		_, exists := mcpServer.tools[toolName]+		assert.True(t, exists, "Expected tool %s to be registered", toolName)+	}++	// Check the number of tools registered+	assert.Equal(t, len(mcpServer.tools), 85)+}++// Mock MCP Server for testing+type mockMCPServer struct {+	tools map[string]server.ServerTool+}++func (m *mockMCPServer) AddTool(tool mcp.Tool, handler server.ToolHandlerFunc) {+	m.tools[tool.Name] = server.ServerTool{+		Tool:    tool,+		Handler: handler,+	}+}

+package tools++import (+	tools "github.com/hashicorp/consul-mcp-server/pkg/tools/functions"+	"github.com/mark3labs/mcp-go/mcp"+	"github.com/mark3labs/mcp-go/server"+	log "github.com/sirupsen/logrus"+)++// MCPServerInterface defines the interface for MCP server operations needed by tools+type MCPServerInterface interface {+	AddTool(tool mcp.Tool, handler server.ToolHandlerFunc)+}++func RegisterTools(hcServer MCPServerInterface, logger *log.Logger) {+	// Consul Catalog tools+	getCatalogServicesTool := tools.GetCatalogServicesTool(logger)+	hcServer.AddTool(getCatalogServicesTool.Tool, getCatalogServicesTool.Handler)++	getCatalogNodesTool := tools.GetCatalogNodesTool(logger)+	hcServer.AddTool(getCatalogNodesTool.Tool, getCatalogNodesTool.Handler)++	getCatalogServiceTool := tools.GetCatalogServiceTool(logger)+	hcServer.AddTool(getCatalogServiceTool.Tool, getCatalogServiceTool.Handler)++	getCatalogConnectTool := tools.GetCatalogConnectTool(logger)+	hcServer.AddTool(getCatalogConnectTool.Tool, getCatalogConnectTool.Handler)++	getCatalogNodeTool := tools.GetCatalogNodeTool(logger)+	hcServer.AddTool(getCatalogNodeTool.Tool, getCatalogNodeTool.Handler)++	getCatalogDatacentersTool := tools.GetCatalogDatacentersTool(logger)+	hcServer.AddTool(getCatalogDatacentersTool.Tool, getCatalogDatacentersTool.Handler)++	getCatalogGatewayServicesTool := tools.GetCatalogGatewayServicesTool(logger)+	hcServer.AddTool(getCatalogGatewayServicesTool.Tool, getCatalogGatewayServicesTool.Handler)++	// Consul Agent Overview tools+	getAgentSelfTool := tools.GetAgentSelfTool(logger)+	hcServer.AddTool(getAgentSelfTool.Tool, getAgentSelfTool.Handler)++	getAgentConfigTool := tools.GetAgentConfigTool(logger)+	hcServer.AddTool(getAgentConfigTool.Tool, getAgentConfigTool.Handler)++	getAgentMembersTool := tools.GetAgentMembersTool(logger)+	hcServer.AddTool(getAgentMembersTool.Tool, getAgentMembersTool.Handler)++	getAgentMetricsTool := tools.GetAgentMetricsTool(logger)+	hcServer.AddTool(getAgentMetricsTool.Tool, getAgentMetricsTool.Handler)++	getAgentHostTool := tools.GetAgentHostTool(logger)+	hcServer.AddTool(getAgentHostTool.Tool, getAgentHostTool.Handler)++	getAgentVersionTool := tools.GetAgentVersionTool(logger)+	hcServer.AddTool(getAgentVersionTool.Tool, getAgentVersionTool.Handler)++	getAgentReloadTool := tools.GetAgentReloadTool(logger)+	hcServer.AddTool(getAgentReloadTool.Tool, getAgentReloadTool.Handler)++	// Consul Agent Check tools+	getAgentChecksTool := tools.GetAgentChecksTool(logger)+	hcServer.AddTool(getAgentChecksTool.Tool, getAgentChecksTool.Handler)++	getAgentCheckTool := tools.GetAgentCheckTool(logger)+	hcServer.AddTool(getAgentCheckTool.Tool, getAgentCheckTool.Handler)++	getAgentCheckByNameTool := tools.GetAgentCheckByNameTool(logger)+	hcServer.AddTool(getAgentCheckByNameTool.Tool, getAgentCheckByNameTool.Handler)+

+	hcServer.AddTool(getAgentServicesTool.Tool, getAgentServicesTool.Handler)+

++import (+	"encoding/json"+	"net/http"+	"net/http/httptest"+	"testing"++	log "github.com/sirupsen/logrus"+	"github.com/stretchr/testify/assert"+)++func TestGetStatusLeaderTool(t *testing.T) {+	logger := log.New()+	tool := GetStatusLeaderTool(logger)++	assert.NotNil(t, tool.Tool)+	assert.NotNil(t, tool.Handler)+	assert.Equal(t, "status_leader", tool.Tool.Name)+}++func TestGetStatusLeaderHandler(t *testing.T) {+	mockLeader := "192.168.1.10:8300"++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {+		assert.Equal(t, "GET", r.Method)+		assert.Equal(t, "/v1/status/leader", r.URL.Path)++		w.Header().Set("Content-Type", "application/json")+		json.NewEncoder(w).Encode(mockLeader)+	}))+	defer server.Close()++	t.Run("successful leader retrieval", func(t *testing.T) {+		// Test would verify leader address is returned correctly+		assert.True(t, true) // Placeholder for actual implementation+	})+}++func TestGetStatusPeersTool(t *testing.T) {+	logger := log.New()+	tool := GetStatusPeersTool(logger)++	assert.NotNil(t, tool.Tool)+	assert.NotNil(t, tool.Handler)+	assert.Equal(t, "status_peers", tool.Tool.Name)+}++func TestGetStatusPeersHandler(t *testing.T) {+	mockPeers := []string{+		"192.168.1.10:8300",+		"192.168.1.11:8300",+		"192.168.1.12:8300",+	}++	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {+		assert.Equal(t, "GET", r.Method)+		assert.Equal(t, "/v1/status/peers", r.URL.Path)++		w.Header().Set("Content-Type", "application/json")+		json.NewEncoder(w).Encode(mockPeers)+	}))+	defer server.Close()++	t.Run("successful peers retrieval", func(t *testing.T) {+		// Test would verify peer list is returned correctly+		assert.True(t, true) // Placeholder for actual implementation+	})+}++func TestStatusResponseProcessing(t *testing.T) {+	t.Run("leader address validation", func(t *testing.T) {+		leaderAddress := "192.168.1.10:8300"++		// Validate leader address format+		assert.Contains(t, leaderAddress, ":")+		assert.Contains(t, leaderAddress, "192.168.1.10")+		assert.Contains(t, leaderAddress, "8300")+	})++	t.Run("peers list validation", func(t *testing.T) {+		peers := []string{+			"192.168.1.10:8300",+			"192.168.1.11:8300",+			"192.168.1.12:8300",+		}

+)++func contextStringValue(ctx context.Context, key contextKey) (string, bool) {+	if value, ok := ctx.Value(key).(string); ok {+		return value, true+	}++	// Preserve compatibility with existing tests and callers that use string keys.+	if value, ok := ctx.Value(string(key)).(string); ok {+		return value, true+	}++	return "", false+}++func contextBoolValue(ctx context.Context, key contextKey) bool {+	if value, ok := ctx.Value(key).(bool); ok {+		return value+	}++	if value, ok := ctx.Value(string(key)).(bool); ok {+		return value+	}++	return false+}++// IsStatelessRequest returns true when this request is being handled by the+// stateless StreamableHTTP transport mode.+func IsStatelessRequest(ctx context.Context) bool {+	return contextBoolValue(ctx, contextKeyMCPStateless)+}+ // NewSessionHandler initializes clients for the session func NewSessionHandler(ctx context.Context, session server.ClientSession, logger *log.Logger) { 	// Create a unique Consul client per session 	consulClient := NewConsulClient(ctx, session.SessionID(), logger)  	if consulClient != nil {-		logger.WithField("session_id", session.SessionID()).Info("Created Consul HTTP client for session")+		logger.Info("Created Consul HTTP client for MCP session") 	} else {-		logger.WithField("session_id", session.SessionID()).Warn("Consul HTTP client is nil for session")+		logger.Warn("Consul HTTP client is nil for MCP session") 	} }  // EndSessionHandler cleans up clients when the session ends func EndSessionHandler(_ context.Context, session server.ClientSession, logger *log.Logger) { 	DeleteConsulHttpClientForSession(session.SessionID())-	logger.WithField("session_id", session.SessionID()).Info("Cleaned up clients for session")+	logger.Info("Cleaned up clients for MCP session") }

-			// Check per-session rate limit if we can get session ID from context-			if sessionID := getSessionIDFromContext(ctx); sessionID != "" {-				sessionLimiter := m.getSessionLimiter(sessionID)-				if !sessionLimiter.Allow() {-					m.logger.Warnf("Session rate limit exceeded for session: %s, tool: %s", sessionID, toolName)-					return nil, errors.New("rate limit exceeded: too many requests from this session")-				}+			// Apply the per-session budget to a trusted server session, or to a+			// shared anonymous bucket when there is no trusted session.+			sessionLimiter := m.getSessionLimiter(getRateLimitKeyFromContext(ctx))+			if !sessionLimiter.Allow() {+				m.logger.Warnf("Session rate limit exceeded for tool: %s", toolName)+				return nil, errors.New("rate limit exceeded: too many requests from this session")

-// getSessionIDFromContext extracts session ID from context-// This is a helper function that tries to get session ID from the context-func getSessionIDFromContext(ctx context.Context) string {+// getRateLimitKeyFromContext extracts a trusted rate-limit bucket from context.+func getRateLimitKeyFromContext(ctx context.Context) string {+	if IsStatelessRequest(ctx) {+		return anonymousRateLimitKey+	}+ 	// Try to get session from context 	if session := server.ClientSessionFromContext(ctx); session != nil {-		return session.SessionID()+		if sessionID := session.SessionID(); sessionID != "" {+			return sessionID+		} 	}-	return ""+	return anonymousRateLimitKey

++	m.mu.Lock()+	defer m.mu.Unlock()++	delete(m.sessionLimiters, sessionID)+	m.logger.Debug("Cleaned up rate limiter for inactive session")

-			m.logger.Debugf("Cleaned up rate limiter for inactive session: %s", sessionID)+			m.logger.Debug("Cleaned up rate limiter for inactive session") 		} 	} }

-	"net/textproto" 	"os" 	"strings" +	"github.com/mark3labs/mcp-go/server" 	log "github.com/sirupsen/logrus" ) @@ -123,32 +123,33 @@ func NewSecurityHandler(handler http.Handler, allowedOrigins []string, corsMode

 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 			ctx := r.Context()+			ctx = context.WithValue(ctx, contextKeyMCPStateless, isStateless)  			// Extract session ID from header-			sessionID := r.Header.Get(textproto.CanonicalMIMEHeaderKey("x-mcp-session-id"))-			if sessionID != "" {-				ctx = context.WithValue(ctx, "session_id", sessionID)-				logger.Debugf("session_id: %s", sessionID)-			}--			// Extract Consul address from header-			consulAddr := r.Header.Get(textproto.CanonicalMIMEHeaderKey("X-Consul-Address"))-			if consulAddr != "" {-				ctx = context.WithValue(ctx, "consul_address", consulAddr)-				logger.Debugf("consul_address: %s", consulAddr)+			sessionID := r.Header.Get(server.HeaderKeySessionID)+			if isStateless {+				if sessionID != "" {+					logger.Debug("Ignoring MCP session ID header in stateless mode")+				}+				r.Header.Del(server.HeaderKeySessionID)+			} else if sessionID != "" {+				ctx = context.WithValue(ctx, contextKeySessionID, sessionID)+				logger.Debug("Received MCP session ID header") 			}  			// Extract Consul token from header-			consulToken := r.Header.Get(textproto.CanonicalMIMEHeaderKey("X-Consul-Token"))+			consulToken := r.Header.Get("X-Consul-Token") 			if consulToken != "" {-				ctx = context.WithValue(ctx, "consul_token", consulToken)+				ctx = context.WithValue(ctx, contextKeyConsulToken, consulToken) 			}  			next.ServeHTTP(w, r.WithContext(ctx))