Skip to content

fix: Add authentication support for Dedicated HTTP configuration - #44

Open
arifulhoque7 wants to merge 39 commits into
php-mcp:mainfrom
arifulhoque7:fix/dedicated-http-authentication
Open

arifulhoque7 wants to merge 39 commits into
php-mcp:mainfrom
arifulhoque7:fix/dedicated-http-authentication

Conversation

@arifulhoque7

Copy link
Copy Markdown

Problem

Authentication was not working with the Dedicated HTTP configuration (mcp:serve --transport=http). The Auth::user() method returned null in tool handlers, while HTTP Integrated mode worked fine.

Root Cause

The Dedicated HTTP transport runs independently of Laravel's HTTP kernel and middleware stack, so authentication context was not available to MCP tools.

Solution

This PR implements a comprehensive authentication bridge that:

  • ✅ Captures authentication context from HTTP requests
  • ✅ Stores context in thread-safe storage
  • ✅ Provides Laravel-style facade for accessing auth data
  • ✅ Works with both HTTP transport modes
  • ✅ Supports all authentication guards (Sanctum, API, Web)
  • ✅ Zero breaking changes

Usage

use PhpMcp\Laravel\Facades\McpAuth;

Mcp::tool('get_me', function () {
    return McpAuth::user() ?? Auth::user();
});

Testing

  • ✅ Comprehensive test suite included
  • ✅ All authentication scenarios covered
  • ✅ Backward compatibility verified

Fixes #35

tsztodd and others added 30 commits May 6, 2025 19:16
Removes in-memory active client tracking (`$activeClients` array and
associated event listeners) from `LaravelHttpTransport`. This local tracking
was unreliable due to Laravel's typical request-response lifecycle where
the transport instance is re-initialized per interaction.

The `ClientStateManager`, which uses a persistent cache, is already
responsible for managing active client state and activity across requests.
The `LaravelHttpTransport` now correctly relies solely on `ClientStateManager`
for queuing messages (`sendToClientAsync`) and updates client activity
via `ClientStateManager` when messages are received.
- Bump `php-mcp/server` to version `^2.3`
- Refactor `McpNotificationListener` to utilize the `Registry` for handling notifications, removing reliance on `ClientStateManager`.
- Clean up unused methods and improve event handling logic in `McpServiceProvider` and `McpNotificationListener`.
When starting the tool is VSCode without providing a transport, it can't "Choose transport protocol for MCP server communication", so we need to explicitly define it.
When MCP clients disconnect from STDIO transport, they close STDOUT/STDERR
streams before the Laravel command completes. Attempting to output
"MCP Server (STDIO) stopped." to closed streams causes fwrite() errors.
…handling

- Updated `php-mcp/server` dependency to version `^3.0` in composer.json.
- Refactored HTTP transport handling by removing the old `McpController` and introducing `SseTransportController` and `StreamableTransportController`.
- Enhanced configuration options in `mcp.php` for dedicated and integrated HTTP transports, including support for JSON responses and event stores.
- Updated routing to use a new web.php file for handling transport routes.
- Improved session management and logging configurations in the MCP setup.
- Adjusted command outputs for clarity when starting the MCP server.
- Added a lottery configuration for session garbage collection in `mcp.php`.
- Updated `LaravelHttpTransport` to include session garbage collection on message requests.
- Refactored `LaravelStreamableHttpTransport` to streamline message handling and improve context management.
- Adjusted command output formatting for better readability when starting the MCP server.
- Add FileSessionHandler with directory auto-creation and proper gc()
- Add DatabaseSessionHandler with base64 encoding and session tracking
- Update McpServiceProvider to construct handlers directly instead of using server builder
- Add session configuration options for file path and database settings
- Include database migration for mcp_sessions table
- Support all Laravel session drivers: array, file, cache, database, redis, memcached, dynamodb
- Refactored tests to replace deprecated methods with updated ones for retrieving tools, resources, and prompts.
- Enhanced assertions in tests to align with the new schema structure for registered elements.
- Updated command tests to reflect changes in the MCP registry and output messages for better clarity.
- Updated the capabilities structure in `mcp.php` to streamline the configuration by removing nested arrays for tools, resources, prompts, and logging.
- Enhanced the `McpServiceProvider` to reflect the new configuration structure, ensuring compatibility with the updated capabilities.
- Added support for completions and clarified the experimental capabilities in the configuration.
tkaratug and others added 9 commits July 1, 2025 14:58
- Changed assertions in ManualRegistrationTest to verify handler as an array containing the handler class and method instead of separate properties.
- Updated tests to reflect the new structure for handler registration, ensuring consistency across tool, resource, and prompt registrations.
- Bump php-mcp/server dependency to ^3.2
- Add support for callable/closure handlers in all MCP element types (tools, resources, resource templates, prompts)
- Introduce inputSchema() method for tools to define custom JSON validation schemas

Breaking: None - all existing v3.0 code remains compatible
Console output methods sometimes write to STDOUT, which interferes with JSON-RPC communication in stdio mode. This redirects startup messages to STDERR when available.
Adds stateless configuration option for both dedicated and integrated HTTP transports. Requires server package 3.3+ for stateless StreamableHttpServerTransport support.
@arifulhoque7
arifulhoque7 force-pushed the fix/dedicated-http-authentication branch 2 times, most recently from 56d519c to 33d9107 Compare May 20, 2026 08:05
@arifulhoque7
arifulhoque7 force-pushed the fix/dedicated-http-authentication branch from 33d9107 to 2075008 Compare May 28, 2026 19:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Authentication not working with Dedicated HTTP configuration

8 participants