Aias00 opened a new issue, #7472:
URL: https://github.com/apache/shenyu/issues/7472

   ## Finding
   
   `McpServerPluginDataHandler.handlerSelector()` overwrites the cached server 
handle and creates transports for the new path, but it never removes the 
previous path for the same selector:
   
   - 
`shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/handler/McpServerPluginDataHandler.java:89-101`
   - 
`shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/handler/McpServerPluginDataHandler.java:109-123`
   - 
`shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/manager/ShenyuMcpServerManager.java:339-357`
   - 
`shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/cache/CommonPluginDataSubscriber.java:338-341`
   
   `removeMcpServer()` is the path that closes transports, removes shared 
server state, and cleans route entries, but it is only called when a selector 
is removed.
   
   ## Trigger / caller flow
   
   An MCP selector is updated from one URI/message endpoint to another, for 
example `/mcp/old/**` to `/mcp/new/**`:
   
   `CommonPluginDataSubscriber.handleSelectorData(selectorData)` -> 
`McpServerPluginDataHandler.handlerSelector(selectorData)` -> 
`CACHED_SERVER.cachedHandle(selectorId, newServer)` -> create transports for 
the new path.
   
   ## Actual behavior
   
   The old path's MCP server/routes are left registered. The new server is 
created for the updated path, but already cached rule tools are not replayed 
onto the new server unless rule updates are resent separately.
   
   ## Expected behavior
   
   Selector path/message-endpoint UPDATE should detect the previous cached 
server for the same selector, remove the old server/routes, create the new 
transports, and register existing cached tools for that selector on the new 
server.
   
   ## Impact
   
   After a selector path update, the old MCP endpoint can remain callable with 
stale routing state, while the new endpoint may advertise no tools until rules 
are toggled or resent.
   
   ## Suggested fix
   
   Before overwriting `CACHED_SERVER`, read the previous `ShenyuMcpServer` for 
the selector. If the normalized path or message endpoint changed:
   
   1. Call `shenyuMcpServerManager.removeMcpServer(oldPath)`.
   2. Create the new transports.
   3. Replay/re-register cached rule tools for that selector on the new server.
   4. Add a regression test that updates a selector URI and verifies old routes 
are gone and existing tools are available on the new path.
   
   ## Existing issue de-dupe
   
   This is distinct from #6473, which covers custom-named rule removal leaving 
tools registered, and from #6117, which covers tools needing reopen after 
bootstrap restart. This issue is about selector URI/message-endpoint UPDATE 
leaving stale old routes and not migrating cached tools.
   
   ## Validation
   
   - Source flow inspected at `a89b6a2338c24e978428b731e8f1edce86022418`.
   - `./mvnw -pl shenyu-plugin/shenyu-plugin-mcp-server 
-Dtest=McpServerPluginDataHandlerTest test -Dcheckstyle.skip -Drat.skip=true 
-Djacoco.skip=true` passed. Existing tests do not cover selector path 
update/migration.
   
   
   
   ## Reviewed Revision And Validation
   
   Apache ShenYu 2.7.2-SNAPSHOT, master at 
a89b6a2338c24e978428b731e8f1edce86022418. Severity: medium. Confidence: high.
   
   Isolated review traced server/route path maps and separate rule tool 
registration; selector-only updates neither remove the old path nor replay 
tools.
   
   Current source references:
   
   - 
`shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/handler/McpServerPluginDataHandler.java:89`
   - 
`shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/handler/McpServerPluginDataHandler.java:109`
   - 
`shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/manager/ShenyuMcpServerManager.java:339`
   - 
`shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/cache/CommonPluginDataSubscriber.java:338`
   
   No implementation fix or full deployed end-to-end validation was performed 
by this review. Source-flow and runtime evidence are distinguished above.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to