fix(mcp): use HTTP/1.1 for the streamable-HTTP transport (drop allowH2)

The MCP transport was the only place in the codebase opting undici into HTTP/2
(`allowH2: true`). undici's h2 support is experimental and has a documented
cluster of stalls where response headers arrive but the body DATA frames never
do, on POST bodies over reused/coalesced sessions (nodejs/undici #2311, #3433,
#4143). Behind a shared egress IP fronted by a CDN, that is exactly what hung the
streamable-HTTP `initialize` after OAuth: 200 + Mcp-Session-Id, then an empty
body until the SDK's 30s timeout — reproducible only from the deployed egress,
never from a fresh IP or in isolation.

h2 buys the MCP transport nothing (one POST per JSON-RPC message plus a single
long-lived SSE stream — no concurrency to multiplex), and both official MCP SDKs
run the transport on HTTP/1.1: the TypeScript SDK's StreamableHTTPClientTransport
calls global fetch (undici h1.1, no allowH2), and the Python SDK builds its httpx
client with no http2=True. Dropping allowH2 aligns with them and steps off the h2
stall surface. CDN fronts serve h1.1 anyway; SSRF IP-pinning and Agent teardown
are unchanged.

Author: waleedlatif1

apps/sim/lib/mcp/pinned-fetch.test.ts

@@ -23,11 +23,37 @@ vi.mock('@/lib/mcp/domain-check', () => ({
   validateMcpServerSsrf: mockValidateMcpServerSsrf,
 }))
 
-import { createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
+import { createPinnedMcpFetch, createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
 
 /** The per-request pinned Agent is always built with a DoS-backstop response cap. */
 const withResponseCap = expect.objectContaining({ maxResponseSize: expect.any(Number) })
 
+describe('createPinnedMcpFetch', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockDestroy.mockResolvedValue(undefined)
+    mockCreatePinnedFetchWithDispatcher.mockReturnValue({
+      fetch: sentinelFetch,
+      dispatcher: { destroy: mockDestroy },
+    })
+  })
+
+  it('builds the transport on HTTP/1.1 — never opts into allowH2 (undici h2 stalls)', () => {
+    const { close } = createPinnedMcpFetch('203.0.113.10')
+
+    // Called with the IP only: no `allowH2`, so the Agent stays on undici's h1.1 default.
+    expect(mockCreatePinnedFetchWithDispatcher).toHaveBeenCalledWith('203.0.113.10')
+    const options = mockCreatePinnedFetchWithDispatcher.mock.calls[0][1] as
+      | { allowH2?: boolean }
+      | undefined
+    expect(options?.allowH2).toBeUndefined()
+
+    // close() tears down the pooled sockets (incl. the long-lived SSE) on disconnect.
+    void close()
+    expect(mockDestroy).toHaveBeenCalledTimes(1)
+  })
+})
+
 describe('createSsrfGuardedMcpFetch', () => {
   beforeEach(() => {
     vi.clearAllMocks()

apps/sim/lib/mcp/pinned-fetch.ts

@@ -8,25 +8,32 @@ import { McpError } from '@/lib/mcp/types'
 export interface PinnedMcpFetch {
   /** Pinned fetch to hand to the MCP transport's `fetch` option. */
   fetch: typeof fetch
-  /** Tears down the underlying HTTP/2 Agent; call when the MCP client disconnects. */
+  /** Tears down the underlying Agent's pooled sockets; call when the MCP client disconnects. */
   close: () => Promise<void>
 }
 
 /**
- * Pinned fetch for the long-lived MCP transport, which reuses one Agent across
- * a connection's requests. MCP servers are commonly behind HTTP/2 fronts (CDNs,
- * cloud LBs), and undici's Agent is h1.1-only unless opted into h2 via ALPN, so
- * the transport enables it. h2 is *not* used for one-shot flows (OAuth discovery,
- * auth-type probe), where a per-request Agent would leave idle h2 sessions with
- * no reuse benefit. Pinning is unaffected: the pinned lookup forces the socket to
- * `resolvedIP` regardless of negotiated protocol. The returned `close` binds the
- * Agent's teardown to the transport lifecycle so h2 sessions don't linger past
- * disconnect.
+ * Pinned fetch for the long-lived MCP transport, which reuses one Agent across a
+ * connection's requests.
+ *
+ * The transport speaks **HTTP/1.1** (undici's default — we do not opt into `allowH2`).
+ * Every stock MCP client does the same: the official SDK's `StreamableHTTPClientTransport`
+ * calls global `fetch` (undici on h1.1) and never touches HTTP/2. h2's only real win is
+ * multiplexing many concurrent requests over one socket, which the MCP transport — one
+ * POST per JSON-RPC message plus a single long-lived SSE stream — never does, so it buys
+ * nothing here. undici's h2 support is still marked experimental and has a documented
+ * cluster of "response headers arrive, body DATA frames never do" stalls on POST bodies
+ * over reused/coalesced sessions (nodejs/undici #2311, #3433, #4143). Behind a shared
+ * egress IP fronted by a CDN, that stall is exactly what hung the streamable-HTTP
+ * `initialize` (200 + `Mcp-Session-Id`, then an empty body until the SDK's 30s timeout).
+ * h1.1 sidesteps that whole surface, and CDN fronts serve h1.1 anyway.
+ *
+ * Pinning is unaffected: the pinned lookup forces the socket to `resolvedIP` regardless of
+ * protocol. The returned `close` binds Agent teardown to the transport lifecycle so pooled
+ * keep-alive sockets (including the SSE connection) don't linger past disconnect.
  */
 export function createPinnedMcpFetch(resolvedIP: string): PinnedMcpFetch {
-  const { fetch: pinnedFetch, dispatcher } = createPinnedFetchWithDispatcher(resolvedIP, {
-    allowH2: true,
-  })
+  const { fetch: pinnedFetch, dispatcher } = createPinnedFetchWithDispatcher(resolvedIP)
   return { fetch: pinnedFetch, close: () => dispatcher.destroy() }
 }