Correctness: Static JSON-RPC ID causes response mismatches in concurrent calls #81

New issue

Open

opened 2026-05-11 13:48:50 +00:00 by thabeta · 0 comments

thabeta commented

2026-05-11 13:48:50 +00:00

Owner

Severity: High

Location

crates/hero_aibroker_lib/src/mcp.rs

Finding

All JSON-RPC requests use a static ID of 1:

let request = json!({
    "jsonrpc": "2.0",
    "id": 1,
    "method": method,
    "params": params,
});

Impact

When multiple concurrent calls are in-flight, responses cannot be matched to requests
Response for call A may be incorrectly returned to caller B
Results in data corruption (wrong tool results, wrong parameters)

Recommendation

Use a monotonically increasing ID counter (AtomicU64)
Match responses to requests by ID
Use a HashMap to track pending requests

## Severity: High ## Location `crates/hero_aibroker_lib/src/mcp.rs` ## Finding All JSON-RPC requests use a static ID of `1`: ```rust let request = json!({ "jsonrpc": "2.0", "id": 1, "method": method, "params": params, }); ``` ## Impact - When multiple concurrent calls are in-flight, responses cannot be matched to requests - Response for call A may be incorrectly returned to caller B - Results in data corruption (wrong tool results, wrong parameters) ## Recommendation - Use a monotonically increasing ID counter (AtomicU64) - Match responses to requests by ID - Use a HashMap to track pending requests