Documentation
¶
Overview ¶
Package server hosts an authorized MCP registry through the official Go SDK. Compact discovery is the default; direct publication requires WithMode(Direct). The application owns listeners, identity, request authentication and calls to Shutdown.
Index ¶
- type AppCSP
- type AppPermissions
- type Apps
- type Mode
- type Option
- func WithApps(value Apps) Option
- func WithIdentity(name, version string) Option
- func WithLogger(logger *slog.Logger) Option
- func WithMode(mode Mode) Option
- func WithResources(resources *mcp.Resources) Option
- func WithStdio(reader io.ReadCloser, writer io.WriteCloser) Option
- func WithTrustedOrigins(origins ...string) Option
- type Server
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AppCSP ¶
type AppCSP struct {
ConnectDomains []string `json:"connectDomains,omitempty"`
ResourceDomains []string `json:"resourceDomains,omitempty"`
FrameDomains []string `json:"frameDomains,omitempty"`
BaseURIDomains []string `json:"baseUriDomains,omitempty"`
}
AppCSP declares browser origins. Empty lists request no external access. Origins use http/https (also ws/wss for connections), optional ports and an optional leading *. subdomain. Paths, credentials and CSP expressions fail. Hosts enforce this policy and may impose further restrictions.
type AppPermissions ¶
type AppPermissions struct {
Camera bool `json:"camera"`
Microphone bool `json:"microphone"`
Geolocation bool `json:"geolocation"`
ClipboardWrite bool `json:"clipboardWrite"`
}
AppPermissions requests browser features; the host may refuse any request. Applications must detect availability before use.
type Apps ¶
type Apps struct {
URI string `json:"uri"`
HTML string `json:"html"`
Views []string `json:"views"`
CSP AppCSP `json:"csp"`
Permissions AppPermissions `json:"permissions"`
}
Apps supplies one public, static HTML5 shell for the compact dispatcher. The host owns HTML correctness and must exclude private data and hidden catalogues. URI is an exclusive, byte-exact Apps mount; do not reuse it in WithResources. Views lists the approved presentation identifiers. HTML is bounded to 8 MiB; the remaining encoded configuration is bounded to 64 KiB.
type Mode ¶
type Mode string
Mode fixes how operations are published. The zero value resolves to Compact.
type Option ¶
type Option func(*configuration) error
Option fixes server configuration at construction. Repeated settings fail.
func WithApps ¶
WithApps snapshots configuration when called and enables the static Apps shell. Apps currently requires Compact mode. The shell is linked from call_tool and omitted from resources/list. It is public to anyone admitted by host middleware; operation and application-resource authorization still runs on every request.
func WithIdentity ¶
WithIdentity sets the advertised server name and version. Their complete JSON representation must fit 4 KiB, leaving room in the final response allowance.
func WithLogger ¶
WithLogger supplies the host's SDK logger. It must not write to protocol stdout.
func WithMode ¶
WithMode selects an immutable publication view. Separate servers may share a registry; discovery never changes their modes or the registry's capacity.
func WithResources ¶
WithResources attaches an explicit resource catalogue with its own host policy. Omitting it leaves resource capabilities unadvertised unless Apps is enabled.
func WithStdio ¶
func WithStdio(reader io.ReadCloser, writer io.WriteCloser) Option
WithStdio selects streams for RunStdio. Once RunStdio starts, the SDK owns and closes them. Reader.Close must unblock a pending Read. Defaults are stdin/stdout.
func WithTrustedOrigins ¶
WithTrustedOrigins names browser origins the HTTP handler accepts besides the request's own. Cross-origin requests are otherwise refused with 403, which is MCP's Origin rule; a non-browser client sends no Origin and is unaffected. Each origin is a scheme and host ("https://studio.example.com"), validated by the standard library's cross-origin protection. Repeating the option adds to the list.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is an immutable publication view with its own admission and lifetime. Obtain Handler without starting a listener. Shutdown stops admission permanently.
func New ¶
New constructs an immutable publication view. Compact is the default. It starts no workers.
Example ¶
package main
import (
"context"
"encoding/json"
"fmt"
"net/http"
mcp "gitlab.com/phpboyscout/go/mcp"
"gitlab.com/phpboyscout/go/mcp/server"
)
func main() {
registry, err := mcp.New([]mcp.Operation{{
Definition: mcp.Definition{Name: "project.status", Summary: "Read project status", InputSchema: json.RawMessage(`{"type":"object","additionalProperties":false}`)},
Handle: func(context.Context, *mcp.Invocation) (mcp.Outcome, error) {
result, err := mcp.TextResult("ready")
return mcp.Finish(result), err
},
}}, mcp.WithPolicy(mcp.AllowRegistered()))
if err != nil {
panic(err)
}
host, err := server.New(registry, server.WithIdentity("project-tool", "0.1.0"))
if err != nil {
panic(err)
}
mux := http.NewServeMux()
mux.Handle("/mcp", host.Handler())
// The application supplies authentication, a listener and controls registration.
// For a CLI, run host.RunStdio(ctx) instead of mounting an HTTP handler.
fmt.Println(host.Status())
fmt.Println(host.Shutdown(context.Background()))
}
Output: <nil> <nil>
func (*Server) Handler ¶
Handler returns the protected SDK Streamable HTTP handler. Host middleware must authenticate requests and put current caller identity in the request context.
func (*Server) RunStdio ¶
RunStdio serves one SDK session and owns the selected streams until it returns. It can run only once. Cancellation and Shutdown close the streams to unblock I/O.
Source Files