Documentation
¶
Index ¶
- Constants
- func ExtractUserToken(oauthCfg *oauth.Config) func(next http.Handler) http.Handler
- func SetCorsHeaders(h http.Handler) http.Handler
- func WithMCPParse() func(http.Handler) http.Handler
- func WithMaxBodySize(maxBytes int64) func(http.Handler) http.Handler
- func WithPATScopes(logger *slog.Logger, scopeFetcher scopes.FetcherInterface) func(http.Handler) http.Handler
- func WithRequestConfig(next http.Handler) http.Handler
- func WithScopeChallenge(oauthCfg *oauth.Config, scopeFetcher scopes.FetcherInterface) func(http.Handler) http.Handler
Constants ¶
const DefaultMaxRequestBodyBytes int64 = 5 << 20 // 5 MiB
DefaultMaxRequestBodyBytes bounds the total HTTP request, not just the tool payload within it. It sits modestly above the MCP SDK's own default to leave room for JSON-RPC and tool-call envelope overhead; because it is the larger of the two, callers must also pass it to the SDK or the SDK would cap it.
Variables ¶
This section is empty.
Functions ¶
func ExtractUserToken ¶
func SetCorsHeaders ¶ added in v1.0.1
SetCorsHeaders is middleware that sets CORS headers to allow browser-based MCP clients to connect from any origin. This is safe because the server authenticates via bearer tokens (not cookies), so cross-origin requests cannot exploit ambient credentials.
func WithMCPParse ¶
WithMCPParse creates a middleware that parses MCP JSON-RPC requests early in the request lifecycle and stores the parsed information in the request context. This enables:
- Registry filtering via ForMCPRequest (only register needed tools/resources/prompts)
- Avoiding duplicate JSON parsing in downstream middlewares
- Access to owner/repo for secret-scanning middleware
The middleware reads the request body, parses it, restores the body for downstream handlers, and stores the parsed MCPMethodInfo in the request context.
func WithMaxBodySize ¶ added in v1.10.0
WithMaxBodySize bounds the size of the request body. It must be registered before any middleware that reads or buffers the body (WithMCPParse, WithScopeChallenge), so an oversized payload is rejected before it is buffered in memory rather than by a later guard in the MCP SDK.
A body of unknown length (chunked, HTTP/2) cannot be rejected upfront, so the limit is instead enforced on read and surfaces as a *http.MaxBytesError to whichever middleware reads the body first.
func WithPATScopes ¶
func WithPATScopes(logger *slog.Logger, scopeFetcher scopes.FetcherInterface) func(http.Handler) http.Handler
WithPATScopes is a middleware that fetches and stores scopes for classic Personal Access Tokens (PATs) in the request context.
func WithRequestConfig ¶
WithRequestConfig is a middleware that extracts MCP-related headers and sets them in the request context. This includes readonly mode, toolsets, tools, lockdown mode, insiders mode, and feature flags.
func WithScopeChallenge ¶
func WithScopeChallenge(oauthCfg *oauth.Config, scopeFetcher scopes.FetcherInterface) func(http.Handler) http.Handler
WithScopeChallenge creates a new middleware that determines if an OAuth request contains sufficient scopes to complete the request and returns a scope challenge if not.
Types ¶
This section is empty.
Source Files