fix(node): reuse getRequestListener instead of creating one per request

[RomKadria]

Problem

NodeStreamableHTTPServerTransport.handleRequest() creates a new getRequestListener from @hono/node-server on every call (line 173), even though the constructor already creates one (this._requestListener, line 80).

The constructor's listener was intended to be reusable — it uses a WeakMap<Request, ...> to pass per-request context. But this approach has a fundamental flaw: the Web Standard Request object is created inside getRequestListener by Hono, so the WeakMap key can never be set before the callback fires. The handleRequest method works around this by creating a new listener per call that closes over authInfo and parsedBody directly.

This means every request allocates a new getRequestListener with its internal conversion infrastructure, contributing to GC pressure under sustained load.

Fix

Replace the WeakMap with AsyncLocalStorage to pass per-request context (authInfo, parsedBody) through to the shared listener callback. This is:

• Concurrent-safe — each request gets its own async context
• Appropriate — this is the Node.js-specific middleware package (packages/middleware/node)
• Zero per-request allocations — the single getRequestListener from the constructor is reused for all requests

Before

async handleRequest(req, res, parsedBody) {
    const handler = getRequestListener(async (webRequest) => {  // NEW per request
        return this._webStandardTransport.handleRequest(webRequest, { authInfo, parsedBody });
    }, { overrideGlobalObjects: false });
    await handler(req, res);
}

After

async handleRequest(req, res, parsedBody) {
    await this._requestContext.run({ authInfo: req.auth, parsedBody }, () => {
        return this._requestListener(req, res);  // reuses constructor's listener
    });
}

Test results

All 74 tests pass (packages/middleware/node).

Relates to #2090

[changeset-bot]

🦋 Changeset detected

Latest commit: a303cc7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@modelcontextprotocol/node	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2091

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2091

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2091

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2091

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2091

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2091

commit: a303cc7