[rudycelekli]

Bug

With observability.metrics.enabled, MetricsManager.HTTPMiddleware is the first middleware on the REST API chi router (setupRoutes), ahead of apiKeyAuthMiddleware. It labels mcpproxy_http_requests_total and mcpproxy_http_request_duration_seconds with r.URL.Path.

So every distinct path creates a new counter series and a new histogram series (11 buckets plus sum and count), and they are never removed. That includes unauthenticated requests that end in 401 or 404, and every server name in /api/v1/servers/{name}/….

Trigger

With metrics enabled, any client that can reach the listener sends requests to distinct paths, for example GET /api/v1/<random> in a loop. A web page open in the user's browser can do this against 127.0.0.1 with fetch(..., {mode: "no-cors"}), and no API key is needed. The daemon's memory and the size of every /metrics scrape then grow without bound.

Fix

Label requests with the chi route pattern they matched (/api/v1/servers/{name}). A request that matched no route gets one fixed unmatched label. Outside a chi router, which no production caller uses, the raw path is kept. The label name (path) and the other labels are unchanged, so the Grafana dashboard, which sums by status, keeps working.

Test

TestHTTPMiddleware_PathLabelIsRoutePattern: a chi router with one /api/v1/servers/{name} route. It receives requests for two server names and two unknown paths. It must end up with exactly two series: the route pattern with count 2, and unmatched with count 2.

Commands run

• CGO_ENABLED=0 go test -count=1 -run 'Test' ./internal/observability/: ok
• On current main, and again with the fix reverted, the new test fails with expected: 2, actual: 4 series.
• go vet ./internal/observability/: ok

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/observability/metrics.go	75.00%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!