M2 upstream: HTTP-split + perf, HttpServerHost fixes, Windows/MSVC, MCP_HTTP_NO_TLS, session-close + client-capabilities hooks

[nicholicaron]

Summary

Lands the post-0.1.0 SDK work as reviewable slices, plus three additive,
non-breaking public-API hooks. All eight commits are on this branch; the tree
builds and passes the full test suite (225/225) in both the default
(MCP_ENABLE_HTTP=ON) and MCP_HTTP_NO_TLS=ON configurations.

Changed / Performance

• HTTP transport split into its own mcp::http target. The core mcp
  library now depends only on nlohmann_json; the Streamable-HTTP transport
  (HttpServerHost / HttpClientTransport) and its cpp-httplib → OpenSSL
  dependency move to a separate mcp::http target (still gated by
  MCP_ENABLE_HTTP, default ON). A stdio-only server linked against mcp::mcp
  now loads no OpenSSL/brotli/Security at all.
  • Breaking (build only): consumers of the HTTP transport must link
    mcp::http instead of mcp::mcp. Stdio-only consumers are unaffected.
• cpp-httplib's optional brotli/zlib auto-detection is pinned off so
  HTTP builds are deterministic regardless of what's installed on the host.
• Request methods no longer spawn a std::thread per call. The per-call
  std::async(std::launch::async) used only to type-convert the result now runs
  as a typed continuation on the session read thread via
  Session::send_request_for<T>(). Measured in-process tools/call throughput
  +~25% and p50 latency −~21% on an Apple Silicon dev machine.

Fixed

• HttpServerHost now honors Options::port (previously always
  bind_to_any_port, silently ignoring a requested fixed port); a bind failure
  on the requested port throws instead of falling back.
• POSTing to a terminated or unknown Mcp-Session-Id now returns 404 as the
  spec requires (the client's cue to re-initialize), instead of 400.

Added

• Windows (MSVC) support for the core + HTTP transport. The POSIX-only
  StdioTransport is compiled out on _WIN32 (its header carries a matching
  #error guard); everything else builds and tests under MSVC.
• MCP_HTTP_NO_TLS CMake option — build the HTTP transport without OpenSSL
  (plaintext only), for loopback deployments and for embedding in processes that
  already ship their own TLS/OpenSSL (game engines, editors). The full test suite
  passes in this configuration and the resulting binaries link no crypto at all.
• examples/http_echo_server — a minimal Streamable-HTTP interop server, verified
  end-to-end against a real MCP client.
• bench/ — in-process micro-benchmarks plus footprint/startup measurements.
• HttpServerHost::Options::on_session_closed — a std::function<void(Server&)>
  invoked exactly once per session on each teardown path (client DELETE, and
  stop() for every surviving session) while the Server is still fully alive,
  before the transport is closed or the Server is destroyed. Lets an embedder
  holding a raw Server* (e.g. a cross-thread logging fan-out) deregister it
  while the pointer is valid, closing a use-after-free window that ~Server
  member-destruction order would otherwise leave open.
• Server::client_capabilities() — std::optional<ClientCapabilities> captured
  at initialize, readable from any thread. Lets an embedder gate optional
  server-initiated flows (sampling, elicitation) on what the connected client
  negotiated, instead of discovering the gap through a round-trip failure.

Windows CI

The windows-latest matrix jobs (Debug + RelWithDebInfo) are the SDK's
first-ever MSVC compile — this PR is how they get proven. MCP_WARNINGS_AS_ERRORS
is off on the Windows job until the MSVC warning surface has been triaged once.

Test plan

• Default config (MCP_ENABLE_HTTP=ON): 225/225 green locally.
• MCP_HTTP_NO_TLS=ON: 225/225 green locally; binaries link no crypto.
• Windows (MSVC) Debug + RelWithDebInfo via CI (first run).
• ASan + TSan sanitizer jobs via CI.
• install + downstream consume via CI.

🤖 Generated with Claude Code