fix(server): guard GET SSE response with CancelScope to prevent Windows deadlock

On Windows + ProactorEventLoop, sse-starlette's EventSourceResponse can
leave orphan child tasks parked in anyio.sleep() or Event.wait() after
client disconnect. These orphans prevent TaskGroup.__aexit__ from
completing, causing _handle_get_request to hang forever. Each hung GET
response accumulates resources until the uvicorn worker deadlocks.

The companion issue PrefectHQ/fastmcp#4192 has a full investigation,
cross-control matrix, and deterministic reproduction confirming the
bug is in the FastMCP wrapper layer's interaction with sse-starlette,
not the SDK's core transport.

Fix: wrap the EventSourceResponse await in _handle_get_request with
an anyio.CancelScope stored on the transport. terminate() cancels this
scope before closing streams, breaking the TaskGroup deadlock and
allowing the session to clean up properly.

Fixes #2653

Author: isheng-eqi

src/mcp/server/streamable_http.py

@@ -188,6 +188,9 @@ def __init__(
         ] = {}
         self._sse_stream_writers: dict[RequestId, MemoryObjectSendStream[SSEEvent]] = {}
         self._terminated = False
+        # CancelScope for the active GET SSE response, so terminate() can
+        # force-cancel a hung EventSourceResponse on Windows (python-sdk#2653).
+        self._active_get_response_scope: anyio.CancelScope | None = None
         # Idle timeout cancel scope; managed by the session manager.
         self.idle_scope: anyio.CancelScope | None = None
 
@@ -743,14 +746,20 @@ async def standalone_sse_writer():
         )
 
         try:
-            # This will send headers immediately and establish the SSE connection
-            await response(request.scope, request.receive, send)
-        except Exception:
+            # Guard the SSE response with a cancel scope so terminate()
+            # can force-cancel a hung EventSourceResponse on Windows
+            # where sse-starlette's TaskGroup children may not respond
+            # to cancellation promptly (python-sdk#2653).
+            self._active_get_response_scope = anyio.CancelScope()
+            with self._active_get_response_scope:
+                await response(request.scope, request.receive, send)
+        except Exception:  # pragma: lax no cover
             logger.exception("Error in standalone SSE response")
+            await self._clean_up_memory_streams(GET_STREAM_KEY)
+        finally:
+            self._active_get_response_scope = None
             await sse_stream_writer.aclose()
             await sse_stream_reader.aclose()
-            await self._clean_up_memory_streams(GET_STREAM_KEY)
-
     async def _handle_delete_request(self, request: Request, send: Send) -> None:  # pragma: no cover
         """Handle DELETE requests for explicit session termination."""
         # Validate session ID
@@ -787,6 +796,11 @@ async def terminate(self) -> None:
         self._terminated = True
         logger.info(f"Terminating session: {self.mcp_session_id}")
 
+        # Cancel any in-flight GET SSE response to prevent
+        # sse-starlette TaskGroup deadlock on Windows (python-sdk#2653).
+        if self._active_get_response_scope is not None:
+            self._active_get_response_scope.cancel()
+
         # We need a copy of the keys to avoid modification during iteration
         request_stream_keys = list(self._request_streams.keys())