Companion

How far the DEFAULT port may climb past DEFAULT_PORT; an explicit port never climbs.

No HTML escaping: it rewrites = as a \u escape, and JVM toString() output is full of = — that bloats the response and leaves its reader decoding noise. The escape only matters inside HTML.

The one path served, matched exactly — /mcp without it is refused like any other miss.

RFC 3986 unreserved — see urlTokenUsable. A generated token (32 hex chars) always matches.

Bind every loopback address this host HAS on ONE shared port, trying tries ports from start, and really give back a port we turn down.

Whether a is configured on an interface of this host — i.e. whether any client's resolver can be sent there at all. The interface table, not a probing bind: a bind answers "can THIS JVM take it", which is a different question, and it needs an ephemeral port that is not always there.

The list as a message spells it: 127.0.0.1, 0:0:0:0:0:0:0:1.

Run body on a daemon thread and wait. HttpServer's dispatcher copies the daemon flag of whichever thread calls start(), and mod init is not one — a dispatcher started from there would keep the JVM alive after /stop. stop(0) joins it, so a released server leaves nothing behind.

Give the bound ports back, started or not: stop() on an unstarted server keeps the port, and start() on a started one throws.

Chunked, not buffered: toJson(body) materializes the document as a String and again as a byte[], and a String also caps how large a response can ever be. Fixing the status at the first byte only costs a 500 an OOM here could not have sent anyway. Orthogonal to SSE — the content type still selects the client's non-SSE path.

Idempotent. Binds the endpoint and logs the port + token; never crashes the game on failure.

One pass over the range: the first port free on every addrs wins, and a port that binds only some of them is given back before moving on. Null once the range is exhausted. Each refusal is logged at DEBUG rather than kept — climbing past a taken port is what this is for, not an anomaly, and a single retained exception would be an arbitrary one of many.