refactor!: switch to stateless HTTP transport (#304)

* refactor!: switch HTTP transport to stateless mode

Each request creates its own McpServer and transport with
sessionIdGenerator: undefined. Removes the session registry,
SSE transport, /messages endpoint, and progress notification
interval. StreamableHTTP is served at both /mcp and /sse for
backward compatibility. GET and DELETE return 405.

* docs: update transport references after stateless HTTP refactor

* fix: catch async errors in Express 4 route handler

Express 4 does not catch rejected promises from async handlers.
Without a try/catch, a failure in connect() or handleRequest()
causes an unhandled rejection that crashes the process.

* chore: upgrade Express to v5

Aligns with the MCP SDK which already depends on Express 5.
Express 5 natively catches async route handler rejections,
so the manual try/catch added in the previous commit is no
longer needed.

* fix: add per-request cleanup and JSON-RPC error middleware

Close transport and McpServer when the response ends, matching
the SDK's recommended pattern for stateless servers. Add Express
error-handling middleware that returns a JSON-RPC error response
instead of Express's default HTML 500.

* fix: use SDK's createMcpExpressApp for DNS rebinding protection

Replace raw express() with the SDK's createMcpExpressApp(), which
applies localhost DNS rebinding protection middleware automatically.
This also handles express.json() globally, removing the need for
per-route body parsing.

Author: GLips

.github/ISSUE_TEMPLATE/bug_report.md

@@ -56,11 +56,10 @@ Configuration:
 - FIGMA_API_KEY: ****8pXg (source: cli)
 - PORT: 3333 (source: default)
 
-Initializing Figma MCP Server in HTTP mode on port 3333...
+Initializing Figma MCP Server in HTTP mode on 127.0.0.1:3333...
 HTTP server listening on port 3333
-SSE endpoint available at http://localhost:3333/sse
-Message endpoint available at http://localhost:3333/messages
-New SSE connection established
+StreamableHTTP endpoint available at http://127.0.0.1:3333/mcp
+StreamableHTTP endpoint available at http://127.0.0.1:3333/sse (backward compat)
 ```
 
 **MCP Logs**

CLAUDE.md

@@ -49,11 +49,10 @@ PRs are squash-merged, so the PR title becomes the commit message that release-p
 
 ### Transport Modes
 
-The server supports three transports (all configured in `src/server.ts`):
+The server supports two transports (configured in `src/server.ts`):
 
 - **stdio** — For direct MCP client integration (activated with `--stdio` flag or `NODE_ENV=cli`)
-- **StreamableHTTP** — Modern HTTP transport at `/mcp`
-- **SSE** — Legacy HTTP transport at `/sse` + `/messages`
+- **StreamableHTTP** — Stateless HTTP transport at `/mcp` (also served at `/sse` for backward compatibility with existing client configs)
 
 ### Core Data Flow
 

package.json

@@ -54,10 +54,10 @@
     "cleye": "^2.2.1",
     "cross-env": "^7.0.3",
     "dotenv": "^16.4.7",
-    "express": "^4.21.2",
+    "express": "^5.2.1",
+    "jimp": "^1.6.0",
     "js-yaml": "^4.1.1",
     "remeda": "^2.20.1",
-    "jimp": "^1.6.0",
     "zod": "^3.25.76"
   },
   "devDependencies": {