AI analysis of just the TMS.MCP.Transport.StreamableHTTP.pas unit came back with this list:
Disconnect leaves a stale SSE connection pointer
One broken SSE client can kill delivery for everybody
Origin validation is bypassable
Browser bearer auth fails CORS preflight
Several transport errors allow malformed JSON/injection
Wrong missing-version behaviour
Replay storage is unbounded
POST does not appear to enforce the legacy Accept requirements
Any advice?