@@ -336,7 +336,7 @@ func (c *Client) Connect(ctx context.Context) error {
 				zap.String("server", c.config.Name),
 				zap.Int("pgid", c.processGroupID))
 
-			if err := killProcessGroup(c.processGroupID, c.logger, c.config.Name); err != nil {
+			if err := killProcessGroup(c.processGroupID, c.processCmd, c.logger, c.config.Name); err != nil {
 				c.logger.Error("Failed to clean up process group after connection failure",
 					zap.String("server", c.config.Name),
 					zap.Int("pgid", c.processGroupID),
 
@@ -348,7 +348,7 @@ func (c *Client) DisconnectWithContext(_ context.Context) error {
 			zap.String("server", serverName),
 			zap.Int("pgid", pgid))
 
-		if err := killProcessGroup(pgid, c.logger, serverName); err != nil {
+		if err := killProcessGroup(pgid, processCmd, c.logger, serverName); err != nil {
 			c.logger.Error("Failed to kill process group",
 				zap.String("server", serverName),
 				zap.Int("pgid", pgid),
@@ -365,6 +365,18 @@ func (c *Client) DisconnectWithContext(_ context.Context) error {
 		}
 	}
 
+	// Step 5b: Release the platform process-group resource regardless of
+	// how the close went. No-op on Unix. On Windows this terminates the
+	// Job Object (reaching grandchildren mcp-go's Close never touches —
+	// it only kills the immediate cmd.exe) and drops its registry entry;
+	// without it, a graceful close leaked the Job handle and left
+	// EOF-ignoring node.exe/python.exe trees alive until mcpproxy exited.
+	// processCmd (captured in Step 1) identifies OUR process, so a PID
+	// that Windows has already handed to a newer connection is left alone.
+	if !isDocker && pgid > 0 {
+		releaseProcessGroup(pgid, processCmd, c.logger, serverName)
+	}
+
 	// Step 6: Stop any locally-launched HTTP/SSE upstream. We do this
 	// AFTER closing the MCP client — the child should see the network
 	// transport go away first, giving it a clean shutdown signal before
 
@@ -323,7 +323,7 @@ func (c *Client) connectStdio(ctx context.Context) error {
 				zap.String("server", c.config.Name),
 				zap.Int("pgid", c.processGroupID))
 
-			if err := killProcessGroup(c.processGroupID, c.logger, c.config.Name); err != nil {
+			if err := killProcessGroup(c.processGroupID, c.processCmd, c.logger, c.config.Name); err != nil {
 				c.logger.Error("Failed to clean up process group after initialization failure",
 					zap.String("server", c.config.Name),
 					zap.Int("pgid", c.processGroupID),
 
@@ -0,0 +1,23 @@
+package core
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap"
+)
+
+// releaseProcessGroup is the platform hook DisconnectWithContext calls on
+// every non-Docker stdio disconnect (after the graceful MCP close), so it
+// must be cheap and safe for the "nothing to release" cases on every OS:
+// the zero/negative sentinels and a PID that never had a Job registered.
+func TestReleaseProcessGroup_NothingToRelease(t *testing.T) {
+	logger := zap.NewNop()
+	for _, pgid := range []int{0, -1, 999999999} {
+		start := time.Now()
+		releaseProcessGroup(pgid, nil, logger, "test-server")
+		assert.Less(t, time.Since(start), 100*time.Millisecond,
+			"releaseProcessGroup(%d) must return immediately when there is nothing to release", pgid)
+	}
+}
@@ -57,8 +57,10 @@ func createProcessGroupCommandFunc(client *Client, workingDir string, logger *za
 }
 
 // killProcessGroup terminates an entire process group on Unix systems
-// This is the proper way to clean up child processes and prevent zombies
-func killProcessGroup(pgid int, logger *zap.Logger, serverName string) error {
+// This is the proper way to clean up child processes and prevent zombies.
+// The cmd argument is the owning process's exec.Cmd; it only matters on
+// Windows (PID-reuse identity check) and is ignored here.
+func killProcessGroup(pgid int, _ *exec.Cmd, logger *zap.Logger, serverName string) error {
 	if pgid <= 0 {
 		return nil
 	}
@@ -155,3 +157,11 @@ func extractProcessGroupID(cmd *exec.Cmd, logger *zap.Logger, serverName string)
 
 	return pgid
 }
+
+// releaseProcessGroup is the platform hook DisconnectWithContext calls after
+// the graceful MCP close on every non-Docker stdio disconnect. On Unix there
+// is nothing to release: process groups are a kernel-side identifier, not a
+// handle we hold, so this is a no-op. See process_windows.go for the
+// platform that needs it (the Job Object handle + registry entry, keyed by
+// PID and disambiguated by the owning cmd).
+func releaseProcessGroup(_ int, _ *exec.Cmd, _ *zap.Logger, _ string) {}
@@ -4,6 +4,7 @@ package core
 
 import (
 	"context"
+	"errors"
 	"os"
 	"os/exec"
 	"sync"
@@ -19,13 +20,21 @@ type ProcessGroup struct {
 	logger *zap.Logger
 }
 
+// windowsJob is one registered Job Object plus the identity of the
+// exec.Cmd it was created for. The cmd pointer is what lets a delayed
+// release tell "my process" from "a newer process that reused my PID".
+type windowsJob struct {
+	job *winjob.Job
+	cmd *exec.Cmd
+}
+
 // windowsJobs maps the "process group ID" mcpproxy uses on Windows (the
 // immediate child's PID — see extractProcessGroupID) to the Job Object that
 // PID was assigned to. killProcessGroup only receives that int, so this is
 // how it finds the Job to terminate.
 var (
 	windowsJobsMu sync.Mutex
-	windowsJobs   = map[int]*winjob.Job{}
+	windowsJobs   = map[int]windowsJob{}
 )
 
 // createProcessGroupCommandFunc creates a custom CommandFunc for Windows systems.
@@ -63,30 +72,34 @@ func createProcessGroupCommandFunc(client *Client, workingDir string, logger *za
 // node.exe/python.exe/qmcp.exe processes accumulated from normal use in
 // under an hour on this host).
 //
+// cmd is the owning exec.Cmd (see releaseProcessGroup for why identity
+// matters: the PID may already belong to a newer connection). Only a Job
+// registered for this cmd is terminated. If the slot is held by someone
+// else, this connection's process is already gone and nothing is killed.
+//
 // Falls back to a plain single-process kill if no job was ever registered
 // for this PID (e.g. job-object setup itself failed) — degrades to the old
-// behaviour rather than doing nothing.
-func killProcessGroup(pgid int, logger *zap.Logger, serverName string) error {
+// behaviour rather than doing nothing. The fallback goes through cmd's own
+// process handle when available (PID-reuse-proof; Windows keeps a PID
+// reserved while a handle to it is open) and only resolves by PID for the
+// legacy nil-cmd case.
+func killProcessGroup(pgid int, cmd *exec.Cmd, logger *zap.Logger, serverName string) error {
 	if pgid <= 0 {
 		return nil
 	}
 
-	windowsJobsMu.Lock()
-	job, ok := windowsJobs[pgid]
-	if ok {
-		delete(windowsJobs, pgid)
-	}
-	windowsJobsMu.Unlock()
-
-	if !ok || job == nil {
+	job := takeWindowsJob(pgid, cmd)
+	if job == nil {
+		if cmd != nil && windowsJobOwnedByOther(pgid, cmd) {
+			logger.Debug("PID now belongs to a newer connection's Job; nothing to kill for this one",
+				zap.String("server", serverName),
+				zap.Int("pid", pgid))
+			return nil
+		}
 		logger.Warn("No Windows Job Object tracked for this process; falling back to killing only the immediate process (any grandchildren will leak)",
 			zap.String("server", serverName),
 			zap.Int("pid", pgid))
-		proc, err := os.FindProcess(pgid)
-		if err != nil {
-			return nil // already gone
-		}
-		return proc.Kill()
+		return killImmediateProcess(pgid, cmd)
 	}
 
 	logger.Info("Terminating process tree via Windows Job Object",
@@ -136,9 +149,7 @@ func extractProcessGroupID(cmd *exec.Cmd, logger *zap.Logger, serverName string)
 		return pid
 	}
 
-	windowsJobsMu.Lock()
-	windowsJobs[pid] = job
-	windowsJobsMu.Unlock()
+	registerWindowsJob(pid, cmd, job, logger, serverName)
 
 	logger.Debug("Process group ID extracted and assigned to Windows Job Object",
 		zap.String("server", serverName),
@@ -147,10 +158,111 @@ func extractProcessGroupID(cmd *exec.Cmd, logger *zap.Logger, serverName string)
 	return pid
 }
 
-// isProcessGroupAlive checks if the process is still running on Windows.
-func isProcessGroupAlive(pgid int) bool {
+// releaseProcessGroup is the platform hook DisconnectWithContext calls on
+// EVERY non-Docker stdio disconnect, whether or not the graceful MCP close
+// succeeded. On Unix it is a no-op. Here it terminates whatever is still
+// in the Job and drops the windowsJobs entry.
+//
+// Why it must run on the graceful path too: mcp-go's Stdio.Close() only
+// ever kills the immediate child (cmd.exe — every Windows stdio command
+// is shell-wrapped) and always returns within ~8s, under the 10s
+// mcpClientCloseTimeout, so Disconnect's force-kill step (which is where
+// killProcessGroup lives) is effectively unreachable on Windows. Without
+// this hook the grandchildren a stdin-EOF-ignoring node.exe/python.exe
+// left behind survived every restart, and the Job handle + map entry
+// leaked per disconnect until mcpproxy exited (#1234 follow-up, F1).
+//
+// cmd identifies the connection's own process: by the time this runs the
+// graceful close may already have reaped cmd.exe, and Windows reuses PIDs
+// eagerly, so a concurrently connecting server can have registered a NEW
+// Job under the same PID. Only the entry registered for this exact cmd is
+// released; if the slot now belongs to someone else, ours was already
+// closed by registerWindowsJob when it took the slot over. A nil cmd
+// disables the identity check (not used by production callers).
+func releaseProcessGroup(pgid int, cmd *exec.Cmd, logger *zap.Logger, serverName string) {
 	if pgid <= 0 {
-		return false
+		return
+	}
+	job := takeWindowsJob(pgid, cmd)
+	if job == nil {
+		// Already killed via killProcessGroup, job setup failed at connect
+		// time (extractProcessGroupID logged a Warn then), or the PID slot
+		// was taken over by a newer process (see above).
+		return
+	}
+	if err := job.Close(); err != nil {
+		logger.Warn("Failed to close Windows Job Object on disconnect",
+			zap.String("server", serverName),
+			zap.Int("pid", pgid),
+			zap.Error(err))
+		return
+	}
+	logger.Debug("Released Windows Job Object; any surviving grandchildren terminated",
+		zap.String("server", serverName),
+		zap.Int("pid", pgid))
+}
+
+// takeWindowsJob removes and returns the Job registered for pid, or nil.
+// When cmd is non-nil the entry is only taken if it was registered for
+// that same cmd. Popping under the lock gives the caller sole ownership
+// of the Close.
+func takeWindowsJob(pid int, cmd *exec.Cmd) *winjob.Job {
+	windowsJobsMu.Lock()
+	defer windowsJobsMu.Unlock()
+	entry, ok := windowsJobs[pid]
+	if !ok || (cmd != nil && entry.cmd != cmd) {
+		return nil
+	}
+	delete(windowsJobs, pid)
+	return entry.job
+}
+
+// windowsJobOwnedByOther reports whether pid has a registered Job that
+// belongs to a different cmd — i.e. Windows reused the PID for a newer
+// connection after this one's process exited.
+func windowsJobOwnedByOther(pid int, cmd *exec.Cmd) bool {
+	windowsJobsMu.Lock()
+	defer windowsJobsMu.Unlock()
+	entry, ok := windowsJobs[pid]
+	return ok && entry.cmd != cmd
+}
+
+// killImmediateProcess is the no-Job fallback: kill just the one process.
+// With a cmd we use its own process handle, which cannot alias a reused
+// PID; an already-exited child is not an error (ErrProcessDone).
+func killImmediateProcess(pid int, cmd *exec.Cmd) error {
+	if cmd != nil && cmd.Process != nil {
+		if err := cmd.Process.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) {
+			return err
+		}
+		return nil
+	}
+	proc, err := os.FindProcess(pid)
+	if err != nil {
+		return nil // already gone
+	}
+	if err := proc.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) {
+		return err
+	}
+	return nil
+}
+
+// registerWindowsJob records the Job for pid. If an entry already exists —
+// Windows reused a PID whose earlier Job has not been released yet — the
+// old Job is closed first rather than silently dropped with its handle
+// (and any straggler still inside it) left open forever. The previous
+// owner's later releaseProcessGroup then finds the slot belongs to a
+// different cmd and does nothing.
+func registerWindowsJob(pid int, cmd *exec.Cmd, job *winjob.Job, logger *zap.Logger, serverName string) {
+	windowsJobsMu.Lock()
+	prev, hadPrev := windowsJobs[pid]
+	windowsJobs[pid] = windowsJob{job: job, cmd: cmd}
+	windowsJobsMu.Unlock()
+
+	if hadPrev {
+		logger.Warn("Windows Job Object already registered for reused PID; closing the stale one",
+			zap.String("server", serverName),
+			zap.Int("pid", pid))
+		_ = prev.job.Close()
 	}
-	return winjob.IsProcessAlive(pgid)
 }