Gitea/MCP
4
0
Fork 0
mirror of https://gitea.com/gitea/gitea-mcp.git synced 2026-08-30 03:57:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat!: support protocol 2026-07-28 over HTTP and add --bind (#227)

Browse Source 
Adds MCP protocol `2026-07-28` over HTTP through the official Go SDK, and validates the `Origin` header on every request as the spec requires.

Tool and Gitea failures now come back as an ordinary `tools/call` result carrying `result.isError: true`, the way the SDK's own tool wrapper reports them. Malformed requests, unknown tools or methods, and server faults stay JSON-RPC errors.

Adds `-b, --bind` to narrow the listen address. The default still accepts every interface, so this is opt-in hardening. It matters because a request that omits `Authorization` falls back to the server's own token.

**Breaking: the HTTP endpoint no longer keeps a session per client.** What changes for a client:

1. `/mcp` accepts `POST` only, and answers `405` to `GET` or `DELETE`.
2. The server neither sends nor accepts `Mcp-Session-Id`, so there is no session handshake to perform.
3. There is no standalone SSE stream and no `Last-Event-ID` resumption. If a response stream breaks, send the whole request again under a new JSON-RPC id.

Clients that already speak current streamable HTTP need no changes. Anything relying on the session handshake or the standalone SSE stream should stay on the previous release.

---------

Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/227
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
This commit is contained in:
Bo-Yi Wu
2026-08-07 15:14:26 +00:00
committed by silverwind
parent efcbdbb17f
commit 75f1adf979
13 changed files with 806 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files
operation/packages/packages_test.go
+14 -19
View File
@@ -299,25 +299,20 @@ func TestPackageWriteDelete(t *testing.T) {
}
}
func TestPackageReadUnknownMethod(t *testing.T) {
ctx := context.Background()
args := map[string]any{
"method": "bogus",
"owner": "test-org",
}
if _, err := packageReadFn(ctx, args); err == nil {
t.Fatal("expected error for unknown method")
}
}
func TestPackageWriteUnknownMethod(t *testing.T) {
ctx := context.Background()
args := map[string]any{
"method": "bogus",
"owner": "test-org",
}
if _, err := packageWriteFn(ctx, args); err == nil {
t.Fatal("expected error for unknown method")
func TestPackageUnknownMethod(t *testing.T) {
for name, fn := range map[string]func(context.Context, map[string]any) (*mcp.CallToolResult, error){
"packageReadFn": packageReadFn,
"packageWriteFn": packageWriteFn,
} {
t.Run(name, func(t *testing.T) {
result, err := fn(context.Background(), map[string]any{"method": "bogus", "owner": "test-org"})
if err != nil {
t.Fatalf("%s() error = %v", name, err)
}
if result == nil || !result.IsError {
t.Fatalf("%s() result = %#v, want an error result", name, result)
}
})
}
}