-
Origins allowed to call the MCP endpoint (DNS-rebinding protection, per the Streamable
HTTP transport spec).
Free-text instructions surfaced to the client at initialize time.
McpConfig.Builder.mechanisms(dev.relism.flash.ext.security.AuthenticationMechanism... mechanisms)
The only mechanisms that authenticate the endpoint, and the only issuers its RFC 9728 metadata
names: any other credential, the session cookie included, is none here.
McpConfig.Builder.middleware(dev.relism.flash.routing.Middleware... middleware)
Runs on the MCP route after the transport guards and authentication — rate limiting, auditing, tracing.
Whether a bearer token must name this endpoint in its aud (RFC 8707), as the MCP
authorization spec requires.
HTTP path for the Streamable HTTP endpoint.
Published as scopes_supported in the RFC 9728 metadata, so OAuth clients request them.
Server version reported in initialize's serverInfo.