ExMCP.Transport.HTTPServer (ex_mcp v1.3.0)

Copy Markdown View Source
This module is deprecated. Use ExMCP.HttpPlug instead. ExMCP.Transport.HTTPServer will be removed in 2.0.0..

HTTP server transport for MCP with security and CORS support.

Deprecated

This module is deprecated and will be removed in 2.0.0. It reads the request body itself, so it cannot run behind Plug.Parsers (every POST forwarded from a stock Phoenix router fails with "Invalid JSON"), its SSE route only matches at the host root, and its initialize response is canned. Use ExMCP.HttpPlug, which handles all of these.

This module provides a Plug-compatible HTTP server that handles MCP requests with comprehensive security features including:

  • Origin header validation (DNS rebinding protection)
  • CORS headers with configurable policies
  • Security headers (XSS, frame options, etc.)
  • HTTPS enforcement
  • Request validation

Simplified example transport

This Plug is retained as a simplified example and includes a canned initialize response. It is not the production HTTP server path. Use ExMCP.HttpPlug for protocol-complete HTTP deployments.

## Usage with Phoenix

  # In your router
  scope "/mcp" do
    forward "/", ExMCP.Transport.HTTPServer,
      handler: MyMCPHandler,
      security: %{
      validate_origin: true,
      allowed_origins: ["https://app.example.com"],
      cors: %{
        allowed_methods: ["GET", "POST", "OPTIONS"],
        allowed_headers: ["Content-Type", "Authorization"],
        allow_credentials: true
      }
    }
end

Usage with Plug.Router

defmodule MyMCPRouter do
  use Plug.Router

  plug :match
  plug :dispatch

  forward "/mcp", to: ExMCP.Transport.HTTPServer,
    init_opts: [
      handler: MyMCPHandler,
      security: %{validate_origin: true}
    ]
end

Security Configuration

The :security option accepts:

  • validate_origin: boolean() - Enable origin validation (default: true)
  • allowed_origins: [String.t()] - List of allowed origins
  • allowed_hosts: [String.t()] - List of allowed host headers
  • enforce_https: boolean() - Require HTTPS for non-localhost (default: true)
  • cors: map() - CORS configuration
  • include_security_headers: boolean() - Include standard security headers (default: true)

Summary

Functions

call(conn, config) deprecated

Handles HTTP requests for MCP.

init(opts) deprecated

Initializes the HTTP server with configuration.

Functions

call(conn, config)

This function is deprecated. Use ExMCP.HttpPlug instead. ExMCP.Transport.HTTPServer will be removed in 2.0.0..

Handles HTTP requests for MCP.

init(opts)

This function is deprecated. Use ExMCP.HttpPlug instead. ExMCP.Transport.HTTPServer will be removed in 2.0.0..

Initializes the HTTP server with configuration.