streamablehttp

type Config struct {
	// Endpoint is the MCP server's URL: https://, or http:// for a loopback
	// host only. It may carry a path and a query — "https://h/mcp?v=2" is an
	// ordinary endpoint — and neither ever appears in RedactedOrigin or in an
	// error, because a query string is a place people put tokens.
	//
	// It is validated once, by New, against exactly the rules auth.Key demands
	// of an origin, so a URL this transport accepts is a URL the token store
	// can key by.
	Endpoint string
	// Headers are static application-supplied headers, attached to every
	// request. A value may be a credential and is treated as one.
	//
	// They are applied before Auth, so a provider and a static header naming the
	// same field resolve in the provider's favour: the live credential wins over
	// the configured one.
	Headers []auth.Header
	// Auth supplies credential headers per request. Nil means no auth headers.
	//
	// It is consulted on every request rather than once per connection, which is
	// what makes an expiring credential work: a provider that refreshes returns
	// the new value on the next request without the connection noticing.
	Auth auth.HeaderProvider
	// HTTPClient is the client to use. Nil selects a client built from Timeouts
	// with TLS 1.2 as its floor, which is the expected case.
	//
	// A supplied client is vetted, not trusted: New refuses one whose transport
	// disables certificate verification, and the transport is cloned and given a
	// TLS 1.2 floor rather than being used as-is — so this package's guarantees
	// hold for a caller's client too, and the caller's client is not mutated. A
	// non-zero Timeout is refused: it is a deadline on a whole exchange, and it
	// would sever the streams this transport is built on.
	//
	// The default client honors the proxy environment (HTTP_PROXY, HTTPS_PROXY,
	// NO_PROXY), as http.DefaultTransport and pkg/auth do. That is worth knowing
	// for a transport this deliberate about what may see a credential: those
	// variables can route this traffic through a host the endpoint does not
	// name. It stays the default because it is what every Go HTTP client does
	// and operators rely on it, and because the exposure is narrow — an https
	// endpoint stays end-to-end encrypted through a proxy's CONNECT, so the
	// proxy sees the host but not the credential, and loopback is exempt.
	// Supply an HTTPClient whose transport sets Proxy: nil to opt out.
	HTTPClient *http.Client
	// Timeouts bounds the network. Zero fields select their defaults.
	Timeouts Timeouts
}

type Timeouts struct {
	// Dial bounds the TCP connect. Zero means DefaultDialTimeout.
	Dial time.Duration
	// TLSHandshake bounds the TLS handshake. Zero means
	// DefaultTLSHandshakeTimeout.
	TLSHandshake time.Duration
	// ResponseHeader bounds the wait for a response's headers, on every
	// request. This is the bound that catches a server which accepts a request
	// and then says nothing — it stops before the body, so it costs a stream
	// nothing. Zero means DefaultResponseHeaderTimeout.
	ResponseHeader time.Duration
	// Frame bounds how long one wire frame may take to arrive, measured from
	// its first byte to its last. Zero means DefaultFrameTimeout.
	//
	// This is the "idle timeout" the transport needs, expressed in the only
	// unit that means anything for a stream that is idle by design. A bound on
	// silence would be wrong: a healthy SSE stream says nothing for hours at a
	// time, and cutting it off for that would break the sessions it is meant to
	// protect. Silence inside a frame the server has already begun is the thing
	// that is never legitimate, and that is what this bounds — see frames.go.
	//
	// It is a completion deadline and not an idle one, deliberately: a deadline
	// that any byte resets is a deadline a server dribbling one byte at a time
	// never trips, which is the attack. A frame that legitimately needs longer
	// than this is a very large frame on a very slow link; raise it.
	Frame time.Duration
	// IdleConn bounds how long a pooled connection is kept alive unused. It is
	// about sockets this transport is not using; for the bound on a server that
	// has gone quiet mid-message, see Frame. Zero means
	// DefaultIdleConnTimeout.
	IdleConn time.Duration
	// Request bounds a whole request that cannot stream — in practice the DELETE
	// that ends the session at Close, which is the one request this transport
	// makes whose response is not, and cannot become, a stream. Zero means
	// DefaultRequestTimeout.
	//
	// It is the bound on how long a server can drag out a shutdown, and that is
	// not only Close's problem: the SDK closes the session itself when a
	// handshake fails, from inside the call, so a cancelled Initialize does not
	// return until the DELETE it triggers has finished or hit this. A server
	// that accepts a DELETE and never answers therefore delays a cancelled
	// caller by up to this long. Lower it if a caller must come back sooner;
	// it cannot be removed, because a DELETE with no bound would hang shutdown
	// outright.
	Request time.Duration
}