barrel_mcp_http_stream (barrel_mcp v2.0.2)

View Source

MCP Streamable HTTP Transport (Protocol Version 2025-03-26).

Implements the MCP Streamable HTTP transport for Claude Code integration on the built-in h1/h2 server (barrel_mcp_http_listener). This transport uses:

  • POST for client requests with JSON or SSE streaming responses.
  • GET for server-to-client notification streams (SSE).
  • DELETE for session termination.
  • OPTIONS for CORS preflight.

The protocol logic lives in barrel_mcp_http_engine; this module only wires the user options to the engine and starts the listener.

Summary

Functions

start(Opts)

Start the Streamable HTTP server.

stop()

Stop the Streamable HTTP server.

Functions

start(Opts)

-spec start(Opts) -> {ok, pid()} | {error, term()}
               when
                   Opts ::
                       #{port => pos_integer(),
                         ip => inet:ip_address(),
                         auth => map(),
                         session_enabled => boolean(),
                         ssl => map(),
                         allowed_origins => [binary()] | any,
                         allow_missing_origin => boolean(),
                         max_connections => pos_integer()}.

Start the Streamable HTTP server.

Security defaults

The server binds to 127.0.0.1 by default. Public binds (any non-loopback IP) require an explicit allowed_origins to prevent DNS-rebinding and CORS-style attacks. The Origin header is validated on every request; mismatches get HTTP 403.

Options

  • port — TCP port (default 9090).
  • ip — bind address (default {127,0,0,1}).
  • auth — authentication provider config.
  • session_enabled — true (default) to use Mcp-Session-Id sessions.
  • ssl — TLS options (certfile, keyfile, optional cacertfile). A TLS bind serves HTTP/1.1 and HTTP/2 on the same port via ALPN.
  • allowed_origins — [binary()] | any.
  • allow_missing_origin — accept requests with no Origin header. Defaults to true on loopback, false otherwise.

stop()

-spec stop() -> ok | {error, not_found}.

Stop the Streamable HTTP server.