Zakaria El OrcheandClaude Opus 5
f28fc43150
flash-ext-security-oauth-server issues RFC 9068 access tokens (code + PKCE S256, CIMD and DCR clients, RFC 8707 resources, rotating refresh tokens) for resources on the application's own origin. Around it: SecurityExtension resolves a configured origin instead of X-Forwarded-* headers, mechanisms expose schemes() and a route can be restricted to some of them, McpConfig.mechanisms(...) uses that, OIDC bearers must be typed at+jwt, and PublicUrl guards outbound fetches against internal addresses. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
flash-ext-mcp
flash-ext-mcp turns a Flash5 app into an MCP (Model Context
Protocol) server: JSON-RPC 2.0 over the Streamable HTTP transport, tools/resources/prompts
declared as plain classes and discovered at boot, optional OAuth2 protection built on
flash-ext-security-core.
Quick Start
FlashApp.create(8080)
.install(new McpExtension(McpConfig.builder("my-mcp-server")
.toolsPackage("com.example.tools")
.build()))
.start();
@Tool(name = "get_weather", description = "Get current weather for a city",
args = @ToolArg(name = "city", description = "City name", required = true))
public class GetWeatherTool extends McpTool {
private WeatherService weatherService;
@Override
protected void onInit() {
weatherService = require(WeatherService.class);
}
@Override
public ToolResponse call(ToolArguments args) {
return ToolResponse.success(new TextContent(weatherService.fetch(args.getString("city"))));
}
}
Operating Model
- One class per tool/resource/prompt — mirrors
RequestHandler: a no-arg constructor,onInit()to cache services fromFlashContext, one hot-path method (call/read/render). No CDI, no field injection, no reflection on the hot path. - Boot-time precompilation —
tools/list/resources/list/prompts/listJSON payloads (including JSON Schema) are built once at boot and spliced verbatim into responses. Seetools-resources-prompts.md. - Transport: Streamable HTTP,
POST-only, stateless in this revision — seetransport.mdfor exactly what that means and why. - Security: authenticated by
flash-ext-security-core, an OAuth2 protected resource when OIDC is installed — seesecurity.md. - JSON: this extension owns its JSON handling independently of
flash-ext-jackson— seejackson-interop.mdfor why, and how a future opt-in reuse could work.
Documents
tools-resources-prompts.md— defining tools, resources, promptstransport.md— Streamable HTTP scope, session/SSE limitations, Origin validationsecurity.md—McpSecuritypolicy, OAuth2 resolution, RFC 9728 / RFC 8707jackson-interop.md— why this extension does not depend onflash-ext-jackson