Package dev.relism.flash.ext.mcp

Class McpConfig.Builder

java.lang.Object
dev.relism.flash.ext.mcp.McpConfig.Builder
Enclosing class:
McpConfig
public static final class McpConfig.Builder extends Object

  • Method Details

    • version

      public McpConfig.Builder version(String version)
      Server version reported in initialize's serverInfo. Default "1.0.0".

    • instructions

      public McpConfig.Builder instructions(String instructions)
      Free-text instructions surfaced to the client at initialize time.

    • rootPath

      public McpConfig.Builder rootPath(String rootPath)
      HTTP path for the Streamable HTTP endpoint. Default "/mcp".

    • toolsPackage

      public McpConfig.Builder toolsPackage(String toolsPackage)
      Package scanned for @Tool/@Resource/@Prompt classes. Required.

    • security

      public McpConfig.Builder security(McpSecurity security)
      OAuth2 requirement policy. Default McpSecurity.AUTO.

    • resourceIdentifier

      public McpConfig.Builder resourceIdentifier(String resourceIdentifier)
      Canonical URI of this MCP endpoint, used for RFC 8707 audience binding: tokens whose aud claim does not include this value are rejected. Optional — when flash-ext-oidc is installed, this is auto-derived per request from the forwarded/Host headers (same resolution OidcExtension uses for its own redirect URIs) and audience binding is enforced unconditionally. Set this explicitly only to override that guess — a reverse proxy that forwards neither X-Forwarded-Host nor X-Forwarded-Proto.

    • authorizationServerIssuer

      public McpConfig.Builder authorizationServerIssuer(String issuer)
      Authorization server issuer URL, published in the RFC 9728 Protected Resource Metadata document at /.well-known/oauth-protected-resource{rootPath}. Optional — when flash-ext-oidc is installed, this is auto-derived from its configured issuer. Set this explicitly only to override that (e.g. publishing a different issuer than the one actually validating tokens).

    • allowedOrigins

      public McpConfig.Builder allowedOrigins(String... origins)
      Origins allowed to call the MCP endpoint (DNS-rebinding protection, per the Streamable HTTP transport spec). If never set, Origin validation is skipped and a warning is logged at boot.

    • scopesSupported

      public McpConfig.Builder scopesSupported(String... scopes)
      OAuth2 scopes this server expects clients to request, published as scopes_supported in the RFC 9728 Protected Resource Metadata document. Optional per the spec — omitted from the document entirely if never set. A spec-compliant client reads this to know what to put in its authorization/token requests instead of requesting nothing; see docs/keycloak.md's "same story for any other claim" section for why this matters in practice (a client that requests no scope only gets whatever your authorization server treats as always-included, e.g. Keycloak's `basic`). Purely advertisement — this server still validates whatever token it actually receives the same way regardless of what a client requested.

    • build

      public McpConfig build()