OptionalallowedOptionalhostOptionalmaxMaximum request body bytes.
OptionalmaxMost concurrent sessions, counting sessions whose sessionFactory.build
is still pending. initialize is the only request that creates one and
nothing but a DELETE removed it, so a client that never ends its
sessions (or a loop of initialize calls) grew the map, and the
per-session MCPServer and layer workspace behind it, without limit. At
the cap one reclaimable session (see sessionIdleMs) is ended to make
room; if there is none the new initialize is refused with 503
session-capacity. Default 1000, the session allowance the cloud and
Autodesk services in this repo already use.
OptionalsessionHow long a session must have been inactive before it may be reclaimed to
make room at maxSessions. Reclaiming happens only under that pressure,
never on a timer, and only for a session that also holds no unpublished
layer drafts, has no request in flight and has no open SSE stream. The
clock restarts when a request settles and when a stream closes. A session
holding drafts is never ended for another client, however long it has
been inactive: only its owner's DELETE (or close()) disposes drafts.
Default 30 minutes, the idle window those same services use.
Browser Origins allowed to read JSON-RPC responses cross-origin. Empty / undefined (the default) means NO browser cross-origin access — a page the user visits cannot read responses or invoke tools. Operators who genuinely need browser access opt in explicitly (CLI
--allow-origin).