Skip to content

Conversation

@arifulhoque7
Copy link

Problem

Authentication was not working with the Dedicated HTTP configuration (mcp:serve --transport=http). The Auth::user() method returned null in tool handlers, while HTTP Integrated mode worked fine.

Root Cause

The Dedicated HTTP transport runs independently of Laravel's HTTP kernel and middleware stack, so authentication context was not available to MCP tools.

Solution

This PR implements a comprehensive authentication bridge that:

  • ✅ Captures authentication context from HTTP requests
  • ✅ Stores context in thread-safe storage
  • ✅ Provides Laravel-style facade for accessing auth data
  • ✅ Works with both HTTP transport modes
  • ✅ Supports all authentication guards (Sanctum, API, Web)
  • ✅ Zero breaking changes

Usage

use PhpMcp\Laravel\Facades\McpAuth;

Mcp::tool('get_me', function () {
    return McpAuth::user() ?? Auth::user();
});

Testing

  • ✅ Comprehensive test suite included
  • ✅ All authentication scenarios covered
  • ✅ Backward compatibility verified

Fixes #35

This commit resolves the authentication issue where Auth::user() returns null
in MCP tool handlers when using the Dedicated HTTP transport mode.

## Problem Solved
- HTTP Integrated mode worked fine (uses Laravel's routing + middleware)
- HTTP Dedicated mode failed authentication (bypassed middleware stack)
- Tools couldn't access authenticated user context

## Solution Implemented
- McpAuthenticationMiddleware: Captures auth context from HTTP requests
- McpContext: Thread-safe storage for authentication data
- McpAuth facade: Laravel-style access to auth context in tools
- Enhanced transport controllers with automatic auth middleware
- Updated service provider with proper dependency registration

## Key Features
✅ Works with both HTTP transport modes (Integrated & Dedicated)
✅ Supports all authentication guards (Sanctum, API, Web)
✅ Automatic Bearer token authentication
✅ Zero breaking changes to existing code
✅ Comprehensive test coverage
✅ Proper security with context isolation

## Usage
```php
use PhpMcp\Laravel\Facades\McpAuth;

Mcp::tool('get_me', function () {
    // Works in both transport modes
    return McpAuth::user() ?? Auth::user();
});
```

## Files Added
- src/Http/Middleware/McpAuthenticationMiddleware.php
- src/Support/McpContext.php
- src/Facades/McpAuth.php
- tests/Feature/AuthenticationTest.php
- examples/AuthenticatedTools.php

## Files Modified
- src/Http/Controllers/*TransportController.php (auth integration)
- src/McpServiceProvider.php (service registration)
- config/mcp.php (default auth middleware)
- samples/basic/routes/mcp.php (usage example)

Fixes authentication issues in Dedicated HTTP configuration while maintaining
full backward compatibility and following Laravel coding standards.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Authentication not working with Dedicated HTTP configuration

1 participant