fix(mcp): run OSV malware check in thread pool to unblock event loop#29192
fix(mcp): run OSV malware check in thread pool to unblock event loop#29192ygd58 wants to merge 1 commit into
Conversation
Synchronous urllib.request.urlopen() in check_package_for_malware() was called directly inside async _run_stdio(), blocking the asyncio event loop during MCP startup. When api.osv.dev SSL handshake hangs (intermittent network issue), the entire event loop freezes for up to 120s — exceeding the TUI 15s startup timeout (issue NousResearch#29184). Two fixes: 1. mcp_tool.py: wrap check_package_for_malware() with asyncio.to_thread() so the blocking urllib call runs in the thread pool executor without stalling the event loop. 2. osv_check.py: add socket.setdefaulttimeout() around urlopen() as a belt-and-suspenders guard — urllib timeout= does not always cover the SSL handshake phase, which is where the freeze occurs. Fixes NousResearch#29184
|
Note: #29190 also fixes this with asyncio.to_thread() + regression test. This PR (#29192) additionally adds socket.setdefaulttimeout() in osv_check.py as a second layer — urllib timeout= does not always cover the SSL handshake phase (confirmed in the stack trace). Both PRs can land; the socket guard is independent. |
|
Acknowledged as duplicate of #29190 for the asyncio.to_thread() fix. The socket.setdefaulttimeout() guard in osv_check.py is an independent improvement — urllib timeout= genuinely does not cover SSL handshake in all Python versions (confirmed in the stack trace: stuck in ssl.py:do_handshake()). Happy to close this PR if the socket guard can be folded into #29190 instead. |
|
Thanks @ygd58 — I folded the independent "OSV check itself must be bounded" concern into #29190 in commit I took a slightly different route than
Relevant PR/body/tests are now updated in #29190. Appreciate you calling out the missing second layer. |
Problem
Synchronous urllib call in check_package_for_malware() blocks the asyncio event loop during MCP startup. SSL handshake hang freezes event loop up to 120s, exceeding TUI 15s timeout.
Fix
Fixes #29184