fix: Add authentication support for Dedicated HTTP configuration - #44
Open
arifulhoque7 wants to merge 39 commits into
Open
arifulhoque7 wants to merge 39 commits into
arifulhoque7 wants to merge 39 commits into
Conversation
…in MCP configuration
… methods and their configurations [skip ci]
Removes in-memory active client tracking (`$activeClients` array and associated event listeners) from `LaravelHttpTransport`. This local tracking was unreliable due to Laravel's typical request-response lifecycle where the transport instance is re-initialized per interaction. The `ClientStateManager`, which uses a persistent cache, is already responsible for managing active client state and activity across requests. The `LaravelHttpTransport` now correctly relies solely on `ClientStateManager` for queuing messages (`sendToClientAsync`) and updates client activity via `ClientStateManager` when messages are received.
- Bump `php-mcp/server` to version `^2.3` - Refactor `McpNotificationListener` to utilize the `Registry` for handling notifications, removing reliance on `ClientStateManager`. - Clean up unused methods and improve event handling logic in `McpServiceProvider` and `McpNotificationListener`.
When starting the tool is VSCode without providing a transport, it can't "Choose transport protocol for MCP server communication", so we need to explicitly define it.
When MCP clients disconnect from STDIO transport, they close STDOUT/STDERR streams before the Laravel command completes. Attempting to output "MCP Server (STDIO) stopped." to closed streams causes fwrite() errors.
…handling - Updated `php-mcp/server` dependency to version `^3.0` in composer.json. - Refactored HTTP transport handling by removing the old `McpController` and introducing `SseTransportController` and `StreamableTransportController`. - Enhanced configuration options in `mcp.php` for dedicated and integrated HTTP transports, including support for JSON responses and event stores. - Updated routing to use a new web.php file for handling transport routes. - Improved session management and logging configurations in the MCP setup. - Adjusted command outputs for clarity when starting the MCP server.
- Added a lottery configuration for session garbage collection in `mcp.php`. - Updated `LaravelHttpTransport` to include session garbage collection on message requests. - Refactored `LaravelStreamableHttpTransport` to streamline message handling and improve context management. - Adjusted command output formatting for better readability when starting the MCP server.
- Add FileSessionHandler with directory auto-creation and proper gc() - Add DatabaseSessionHandler with base64 encoding and session tracking - Update McpServiceProvider to construct handlers directly instead of using server builder - Add session configuration options for file path and database settings - Include database migration for mcp_sessions table - Support all Laravel session drivers: array, file, cache, database, redis, memcached, dynamodb
- Refactored tests to replace deprecated methods with updated ones for retrieving tools, resources, and prompts. - Enhanced assertions in tests to align with the new schema structure for registered elements. - Updated command tests to reflect changes in the MCP registry and output messages for better clarity.
- Updated the capabilities structure in `mcp.php` to streamline the configuration by removing nested arrays for tools, resources, prompts, and logging. - Enhanced the `McpServiceProvider` to reflect the new configuration structure, ensuring compatibility with the updated capabilities. - Added support for completions and clarified the experimental capabilities in the configuration.
- Changed assertions in ManualRegistrationTest to verify handler as an array containing the handler class and method instead of separate properties. - Updated tests to reflect the new structure for handler registration, ensuring consistency across tool, resource, and prompt registrations.
- Bump php-mcp/server dependency to ^3.2 - Add support for callable/closure handlers in all MCP element types (tools, resources, resource templates, prompts) - Introduce inputSchema() method for tools to define custom JSON validation schemas Breaking: None - all existing v3.0 code remains compatible
Console output methods sometimes write to STDOUT, which interferes with JSON-RPC communication in stdio mode. This redirects startup messages to STDERR when available.
Adds stateless configuration option for both dedicated and integrated HTTP transports. Requires server package 3.3+ for stateless StreamableHttpServerTransport support.
arifulhoque7
force-pushed
the
fix/dedicated-http-authentication
branch
2 times, most recently
from
May 20, 2026 08:05
56d519c to
33d9107
Compare
arifulhoque7
force-pushed
the
fix/dedicated-http-authentication
branch
from
May 28, 2026 19:16
33d9107 to
2075008
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Authentication was not working with the Dedicated HTTP configuration (
mcp:serve --transport=http). TheAuth::user()method returnednullin tool handlers, while HTTP Integrated mode worked fine.Root Cause
The Dedicated HTTP transport runs independently of Laravel's HTTP kernel and middleware stack, so authentication context was not available to MCP tools.
Solution
This PR implements a comprehensive authentication bridge that:
Usage
Testing
Fixes #35