6#include <condition_variable>
15#include <unordered_map>
18#if defined(CXXMCP_ENABLE_AUTH)
27namespace mcp::server {
57 std::optional<std::string>
scope;
81 std::vector<std::string>
allowed_hosts = {
"localhost",
"127.0.0.1",
"::1"};
117#if defined(CXXMCP_ENABLE_AUTH)
189 std::string_view session_id,
198 std::string_view session_id)
const override;
209 std::string_view session_id,
235 protocol::Json params) override;
238 std::string_view
name() const noexcept override;
244 struct HttpServerHolder;
246 struct PendingRequest {
248 std::condition_variable cv;
250 std::optional<protocol::JsonRpcResponse> response;
251 std::optional<core::Error> error;
255 std::optional<std::uint64_t> event_id;
259 struct ProgressResponseSink {
261 std::condition_variable cv;
262 std::deque<std::string> events;
267 struct SubscriptionSink {
269 std::condition_variable cv;
270 std::deque<std::string> events;
273 std::string subscription_id;
275 protocol::Json filter = protocol::Json::object();
278 struct SessionState {
279 std::string session_id;
280 bool initialized =
false;
282 std::deque<QueuedEvent> pending_notifications;
283 std::size_t pending_notification_bytes = 0;
284 std::deque<QueuedEvent> replay_notifications;
285 std::unordered_map<std::string, std::shared_ptr<PendingRequest>>
287 std::uint64_t next_notification_event_id = 1;
288 std::size_t active_sse_streams = 0;
289 bool sse_disconnect_requested =
false;
290 std::shared_ptr<ProgressResponseSink> active_progress_sink;
293 void abort_pending_requests_locked(SessionState& session,
294 std::string message);
295 void clear_outbound_events_locked(SessionState& session);
296 core::Result<core::Unit> enqueue_outbound_event_locked(SessionState& session,
298 void remember_replay_event_locked(SessionState& session,
299 const QueuedEvent& event);
300 SessionState* find_session_locked(std::string_view session_id);
301 const SessionState* find_session_locked(std::string_view session_id)
const;
302 SessionState* select_default_session_locked();
303 void close_sse_stream(std::string_view session_id)
noexcept;
305 static std::optional<protocol::ProgressToken> extract_progress_token(
306 const protocol::JsonRpcRequest& request);
308 HttpTransportOptions options_;
309 std::unique_ptr<HttpServerHolder> server_;
310 mutable std::mutex mutex_;
311 std::condition_variable notification_cv_;
312 std::condition_variable startup_cv_;
313 std::unordered_map<std::string, SessionState> sessions_;
314 std::vector<std::shared_ptr<SubscriptionSink>> subscription_sinks_;
315 std::uint64_t next_session_id_ = 1;
316 bool stopped_ =
false;
317 bool stop_requested_ =
false;
318 bool startup_finished_ =
false;
319 bool initialized_ =
false;
320 std::string default_session_id_;
ClientCapabilitiesBuilder client_capabilities()
Starts a fluent client capability builder.
Definition capabilities.hpp:397
MCP streamable HTTP transport with session-aware SSE delivery.
Definition http_transport.hpp:155
std::string_view name() const noexcept override
Return the diagnostic transport name "http".
std::optional< protocol::ClientCapabilities > client_capabilities_for_session(std::string_view session_id) const override
Return capabilities from a specific initialized HTTP session.
std::optional< protocol::ClientCapabilities > client_capabilities() const override
Return capabilities from the active initialized HTTP session.
core::Result< core::Unit > start(RequestHandler handler, NotificationHandler notification_handler={}) override
Start the HTTP server and serve the configured MCP endpoint.
core::Result< protocol::JsonRpcResponse > send_request(const protocol::JsonRpcRequest &request) override
Queue a server-to-client request on the active SSE stream.
core::Result< protocol::JsonRpcResponse > send_request_to_session(std::string_view session_id, const protocol::JsonRpcRequest &request) override
Queue a server-to-client request for a specific HTTP session.
void stop() noexcept override
Stop the HTTP server and fail pending outbound requests.
void publish_subscription_notification(std::string_view method, protocol::Json params) override
Publish a notification to open subscriptions/listen streams (SEP-2575).
void disconnect_session_sse(std::string_view session_id)
Request a server-initiated SSE stream disconnect for a session.
~HttpTransport() override
Destroy the transport and its underlying server state.
void wait_until_ready() override
Blocks until the underlying HTTP server socket is bound.
core::Result< core::Unit > send_notification_to_session(std::string_view session_id, const protocol::JsonRpcNotification ¬ification) override
Queue an outbound notification for a specific HTTP session.
HttpTransport(HttpTransportOptions options)
Construct a transport with normalized HTTP options.
core::Result< core::Unit > send_notification(const protocol::JsonRpcNotification ¬ification) override
Queue an outbound notification for the active SSE stream.
Abstract server transport for receiving client JSON-RPC messages.
Definition transport.hpp:154
tl::expected< T, Error > Result
Alias for the SDK result type.
Definition result.hpp:64
Server-side transport abstraction for MCP JSON-RPC traffic.
std::function< core::Result< protocol::JsonRpcResponse >(const protocol::JsonRpcRequest &, const SessionContext &)> RequestHandler
Callback used by transports to dispatch inbound JSON-RPC requests.
Definition transport.hpp:75
std::function< core::Result< core::Unit >(const protocol::JsonRpcNotification &, const SessionContext &)> NotificationHandler
Callback used by transports to dispatch inbound JSON-RPC notifications.
Definition transport.hpp:139
Abstract interfaces for server-side OAuth 2.1 endpoint handlers.
OAuth authorization server endpoint wiring owned by the auth layer.
Definition server_auth_endpoints.hpp:180
JSON-RPC notification envelope for one-way MCP messages.
Definition types.hpp:137
JSON-RPC request envelope carrying an MCP method invocation.
Definition types.hpp:99
Configuration for the HTTP WWW-Authenticate challenge header.
Definition http_transport.hpp:49
std::string scheme
Authentication scheme (default: "Bearer").
Definition http_transport.hpp:51
std::optional< std::string > resource_metadata_url
URL of the RFC 9728 Protected Resource Metadata document.
Definition http_transport.hpp:54
std::optional< std::string > scope
Scopes required to access the resource.
Definition http_transport.hpp:57
Configuration for HttpTransport.
Definition http_transport.hpp:61
ProtectedResourceMetadataConfig protected_resource_metadata
RFC 9728 Protected Resource Metadata.
Definition http_transport.hpp:116
std::size_t max_sse_replay_events
Number of delivered SSE events retained for Last-Event-ID replay.
Definition http_transport.hpp:87
std::chrono::milliseconds read_timeout
Socket read timeout for HTTP request handling.
Definition http_transport.hpp:95
std::vector< std::string > allowed_origins
Optional Origin allow-list. Empty means Origin is not restricted.
Definition http_transport.hpp:78
int listen_port
TCP port to listen on. Must be in the range 1..65535.
Definition http_transport.hpp:65
std::vector< std::string > allowed_hosts
Host allow-list used to reject DNS-rebinding attempts.
Definition http_transport.hpp:81
std::chrono::milliseconds request_timeout
Maximum time to wait for a client response to a server-to-client request.
Definition http_transport.hpp:90
std::size_t max_pending_sse_events
Maximum server-to-client events waiting for an SSE stream.
Definition http_transport.hpp:83
std::size_t max_sessions
Maximum active HTTP sessions accepted by this transport.
Definition http_transport.hpp:100
std::chrono::milliseconds write_timeout
Socket write timeout for HTTP response handling.
Definition http_transport.hpp:97
bool stateless
Enable stateless MCP mode (SEP-2575).
Definition http_transport.hpp:104
std::size_t max_pending_sse_bytes
Maximum serialized bytes waiting for an SSE stream.
Definition http_transport.hpp:85
std::chrono::milliseconds sse_disconnect_retry
Retry hint (ms) sent to the client before a server-initiated SSE disconnect.
Definition http_transport.hpp:76
bool enable_sse_polling
Enable SEP-1699 SSE polling: always send a priming event with id on SSE streams and allow server-init...
Definition http_transport.hpp:73
std::string path
HTTP path for POST, GET/SSE, and DELETE session requests.
Definition http_transport.hpp:67
AuthChallengeConfig auth_challenge_config
Structured auth challenge configuration.
Definition http_transport.hpp:113
std::size_t max_request_body_bytes
Maximum HTTP request body size accepted by the underlying server.
Definition http_transport.hpp:93
std::string listen_host
Interface address passed to the underlying HTTP server.
Definition http_transport.hpp:63
std::string auth_challenge
HTTP WWW-Authenticate challenge emitted when authentication fails.
Definition http_transport.hpp:109
std::optional< std::chrono::milliseconds > sse_retry
Optional SSE retry interval hint for the priming event.
Definition http_transport.hpp:69