Skip to content

Conversation

stantonk
Copy link
Contributor

@stantonk stantonk commented Aug 10, 2025

Implements #476.

Motivation and Context

#420 introduced McpTransportContext.

McpTransportContext should be supported in HttpServletSseServerTransportProvider to enable those who are still on that transport to leverage McpTransportContext to set attributes that Tools, etc. have access to. This is crucial for implementing Authentication & Authorization at the Tool level.

Current Behavior

McpTransportContext is absent from HttpServletSseServerTransportProvider

Context

How has this issue affected you?

We're not able to switch to HttpServletStreamableServerTransportProvider yet, but wish to use McpTransportContext instead of our custom built similar capability.

What are you trying to accomplish?

Authn/z at Tool level.

How Has This Been Tested?

  • In a langchain4j agent application calling into a Dropwizard application serving MCP using HttpServletSseServerTransportProvider
  • directly by testing a Dropwizard application serving MCP using HttpServletSseServerTransportProvider
  • Integration tests included with PR

Breaking Changes

No, use of the McpTransportContext is optional.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

None

@stantonk stantonk changed the title Feature/mcp transport context for http servlet sse server transport provider Feature: McpTransportContext for HttpServletSseServerTransportProvider Aug 10, 2025
@tzolov tzolov requested a review from chemicL August 10, 2025 09:08
Copy link
Member

@chemicL chemicL left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I think this is useful and seems you found a way around the singleton behaviour of the exchange object :) Left some comments to improve a few things, but I agree we should merge this once fixed. Also, would you consider following up with the Spring-related SSE transport providers to maintain feature parity?

@stantonk
Copy link
Contributor Author

@chemicL thanks for the quick review! All your suggestions make sense, I'll get those updates made.

RE: Spring support, I've never used Spring but I can take a pass at it, probably this weekend. If I hit some snags would you be open to merging the Servlet version in first? I just don't want to stay on our internal fork for too long as additional capabilities and bug fixes get merged in.

stantonk and others added 6 commits August 17, 2025 16:57
…ch request in handleIncomingRequest and handleIncomingNotification
…ody to peform assertions within JUnit test thread; since callHandler may run on a different thread
…ientServerIntegrationTests.java

Co-authored-by: Dariusz Jędrzejczyk <[email protected]>
@stantonk stantonk requested a review from chemicL August 17, 2025 23:13
@stantonk
Copy link
Contributor Author

@chemicL thanks again for the review!

Updates

  • I've made all your recommended updates

Testing

  • I re-ran mvn clean verify locally and all tests passed
  • I ran mvn clean install locally, and configured our Dropwizard MCP Service to use the latest HEAD of this PR after all your requested changes. I confirmed our AI Agent service talking to our Dropwizard MCP Service is functioning properly with the latest changes, including our Authentication & Authorization into the individual MCP Tool call level via the McpTransportContextExtractor using HttpServletSseServerTransportProvider. Initialization, list tools, and tool calls are working properly.

Spring WebMvc and WebFlux

I took a quick look through the code, it all looks pretty similar so I should be able to follow up in a subsequent PR adding McpTransportContext to those as well. I've got a busy week coming up, but I'll try for next weekend.

@tzolov tzolov self-assigned this Aug 25, 2025
Comment on lines +317 to +324
// This legacy implementation assumes an exchange is established upon
// the initialization phase see: exchangeSink.tryEmitValue(...),
// which creates a cached immutable exchange.
// Here, we create a new exchange and copy over everything from that
// cached exchange, and use it for a single HTTP request, with the
// transport context passed in.
McpAsyncServerExchange newExchange = new McpAsyncServerExchange(exchange.sessionId(), this,
exchange.getClientCapabilities(), exchange.getClientInfo(), transportContext);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be extracted to a utility method to avoid the copy of the comment.

HttpResponse<String> response = HttpClient.newHttpClient()
.send(HttpRequest.newBuilder()
.uri(URI.create(
"https://raw.githubusercontent.com/modelcontextprotocol/java-sdk/refs/heads/main/README.md"))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose there is no need to call an external API in this test. I'd say we don't need to call anything, just return the contents of the context from the tool.

Comment on lines +1602 to +1605
protected static McpTransportContextExtractor<HttpServletRequest> TEST_CONTEXT_EXTRACTOR = (r, tc) -> {
tc.put("important", "value");
return tc;
};
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could have a copy of this in both HttpServletSseIntegrationTests and HttpServletStreamableIntegrationTests to avoid a reference to a servlet type in the base class.

BTW, I thought this abstract test can be used outside of the servlet context, but it seems the variant in mcp-test module is not really a copy.. @tzolov do we have a strategy for aligning these? There's no comment like we have in other files of this sort (// KEEP IN SYNC with the class in mcp-test module)...

tzolov added a commit that referenced this pull request Aug 26, 2025
- Add McpTransportContextExtractor to WebFlux/WebMVC SSE and Streamable transport providers
- Enable extraction of HTTP transport metadata (headers, etc.) for use during request processing
- Pass transport context through reactive context chain using McpTransportContext.KEY
- Add contextExtractor() builder methods for configuring custom extractors
- Update HttpServlet transport providers with same context extraction capability
- Modify McpServerSession to properly propagate transport context to handlers
- Add test coverage with TEST_CONTEXT_EXTRACTOR in integration tests

This allows MCP feature implementations to access HTTP transport level metadata
that was present at request time, enabling use cases like authentication,
request tracing, and custom header processing.

Signed-off-by: Christian Tzolov <[email protected]>

Co-authored-by: Christian Tzolov <[email protected]>
Co-authored-by: Dariusz Jędrzejczyk <[email protected]>
tzolov added a commit that referenced this pull request Aug 26, 2025
- Add McpTransportContextExtractor to WebFlux/WebMVC SSE and Streamable transport providers
- Enable extraction of HTTP transport metadata (headers, etc.) for use during request processing
- Pass transport context through reactive context chain using McpTransportContext.KEY
- Add contextExtractor() builder methods for configuring custom extractors
- Update HttpServlet transport providers with same context extraction capability
- Modify McpServerSession to properly propagate transport context to handlers
- Add test coverage with TEST_CONTEXT_EXTRACTOR in integration tests

This allows MCP feature implementations to access HTTP transport level metadata
that was present at request time, enabling use cases like authentication,
request tracing, and custom header processing.

Signed-off-by: Christian Tzolov <[email protected]>

Co-authored-by: Christian Tzolov <[email protected]>
Co-authored-by: Dariusz Jędrzejczyk <[email protected]>
@tzolov tzolov added this to the 0.12.0 milestone Aug 26, 2025
@tzolov
Copy link
Contributor

tzolov commented Aug 26, 2025

rebased, extended, squashed and merged at b4fef52

Additionally:

  • Port the feature to the WebMvcSseServerTransportProvider and WebFluxSseServerTransportProvider
  • Align the AbstractStatelessIntegrationTests in the mcp and mcp-test modules.
  • Fix an context propagation issue in the WebFluxStreamableServerTransportProvider
  • minor code/test cleaning and improvements
  • backported to 0.11.x

@tzolov tzolov closed this Aug 26, 2025
@stantonk
Copy link
Contributor Author

@tzolov @chemicL thanks for all your help on this! @tzolov appreciate you porting to WebMvcSseServerTransportProvider and WebFluxSseServerTransportProvider!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants