Documentation
¶
Overview ¶
Package mcpserver bridges core DML tools to the MCP go-sdk. It registers the enabled tools with an mcp.Server, adapts CallToolRequest to tool.Run, and maps core errors to MCP results: business errors (unauthorized, cost-exceeded, unsafe-write, not-found) become IsError results with actionable text, while overload/circuit/internal errors become protocol-level errors.
Index ¶
- func Handler(s *mcp.Server, cfg HTTPConfig) (http.Handler, error)
- func NewRuntimeServer(runtime *bootstrap.Runtime) *mcp.Server
- func NewServer(app *bootstrap.App) *mcp.Server
- func ServeHTTP(ctx context.Context, s *mcp.Server, cfg HTTPConfig) error
- func ServeStdio(ctx context.Context, s *mcp.Server) error
- func WithSubject(ctx context.Context, role string, attrs map[string]any) context.Context
- type HTTPConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Handler ¶ added in v0.1.5
Handler returns the fully hardened HTTP handler (token auth, body caps, proxy trust, session identity binding, /mcp, /healthz, optional /metrics) without binding a listener. ServeHTTP serves this same handler; tests and embedders can mount it on their own server so the middleware chain under test is identical to production.
func NewRuntimeServer ¶
NewRuntimeServer builds a server whose handlers acquire the current app snapshot for every request. Tool discovery reflects the snapshot at server creation; request execution and resources always use the latest snapshot.
func ServeHTTP ¶
ServeHTTP runs the server on streamable HTTP with authentication, request hardening (timeouts, header/body caps), a /healthz check, and an optional /metrics endpoint. See HTTPConfig for the security model.
func ServeStdio ¶
ServeStdio runs the server on stdio.
func WithSubject ¶
WithSubject attaches a per-request caller identity (role + attributes) to ctx. A trusted transport or gateway sets it after authenticating the caller; ServeHTTP derives it from request headers. Tool handlers read it to build a role- and tenant-scoped context, so a single process is no longer pinned to one role. Exported so custom transports can inject an authenticated subject.
Types ¶
type HTTPConfig ¶
type HTTPConfig struct {
Addr string
Token string // shared-secret bearer token; empty disables token auth
TrustProxyHeaders bool // trust X-MCP-Role/X-MCP-Subject identity headers
TrustedProxyCIDRs []string
TLSCert string
TLSKey string
ClientCA string // PEM bundle; when set, require+verify a client cert (mTLS)
ReadHeaderTimeout time.Duration
ReadTimeout time.Duration
WriteTimeout time.Duration
IdleTimeout time.Duration
MaxHeaderBytes int
MaxBodyBytes int64
Metrics http.Handler
SessionTimeout time.Duration
OnSessionClosed func(string)
}
HTTPConfig configures the streamable HTTP transport, including authentication and hardening. Zero-valued timeout/size fields receive safe defaults. Metrics is an optional handler mounted at /metrics.
Source Files