Restore legacy MCP SSE transport compatibility

[Mike Krüger (mkrueger)]

Summary

Restore legacy MCP HTTP+SSE compatibility alongside Streamable HTTP on the existing --mcp server using MCP SDK 2.2.

• Enable the SDK's legacy /sse and /message endpoints without an additional CLI option.
• Preserve loopback binding, origin validation, and shared shell state.
• Bound outstanding legacy requests to 16 across all SSE sessions. Reject excess POSTs with HTTP 429 before SDK dispatch, without queuing.
• Retain admission through SSE response writes, including errors, with cleanup on cancellation and session closure. Keep replies and cancellation notifications available.
• Cover both transports, shared tools/resources, origin validation, overload handling, slow response writers, and admission cleanup.
• Update CLI help, localization, user documentation, and the Unreleased changelog.

[Copilot]

🟡 Changes recommended

Legacy SSE is enabled without bounding the documented unbackpressured request concurrency in the shared shell process.

1 open finding

• Legacy SSE lacks request limits, allowing unbounded queued work · New

What changed in this PR

Restores legacy MCP HTTP+SSE compatibility alongside Streamable HTTP on the existing loopback server.

Changes:

• Enables SDK 2.2 legacy SSE endpoints.
• Expands transport, subscription, and origin-validation tests.
• Updates help, documentation, localization, and changelog content.

File	Description
README.md	Documents both MCP transports.
CHANGELOG.md	Records restored SSE compatibility.
docs/​navigation.md	Updates --mcp usage.
docs/​mcp.md	Documents endpoints and limitations.
CosmosDBShell/​lang/​en.ftl	Updates localized help source.
l10n/​CosmosDBShell.json	Regenerates the English catalog.
CosmosDBShell/​Azure.Data.Cosmos.Shell.Mcp/​McpServer.cs	Enables legacy SSE.
CosmosDBShell.Tests/​McpLocationSubscriptionTests.cs	Tests both transports and endpoint security.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall line coverage in commit 42094a4 in the dev/mkrueger/fix/res... branch is 67%. The line coverage in commit 3a9dc25 in the main branch is 66%.

Show a line coverage summary of the most impacted files.

File	main 3a9dc25	dev/mkrueger/fix/res... 42094a4	+/-
D:\a\CosmosDBSh...cp\McpServer.cs	100%	100%	0%
D:\a\CosmosDBSh...onMiddleware.cs	92%	96%	+4%
D:\a\CosmosDBSh...ttpAdmission.cs	0%	96%	+96%
D:\a\CosmosDBSh...questLimiter.cs	0%	100%	+100%

---

_{Updated October 09, 2026 11:59 UTC}

[Copilot]

🟡 Changes recommended

Rejected legacy requests can still accumulate as unbounded SDK response tasks under sustained overload.

1 open finding

• Rejected requests can accumulate unbounded SDK response tasks · New

1 resolved since last review

• Legacy SSE lacks request limits, allowing unbounded queued work

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Concurrency-sensitive SSE admission and session-lifecycle behavior merits final human validation despite comprehensive tests.

0 open findings

1 resolved since last review

• Rejected requests can accumulate unbounded SDK response tasks

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The previous backpressure concerns are addressed with layered admission control, cleanup, comprehensive tests, and aligned documentation.

0 open findings

🧠 Review effort: Balanced