mirror of
https://gitea.com/gitea/gitea-mcp.git
synced 2026-08-21 23:57:46 +00:00
75f1adf979
Adds MCP protocol `2026-07-28` over HTTP through the official Go SDK, and validates the `Origin` header on every request as the spec requires. Tool and Gitea failures now come back as an ordinary `tools/call` result carrying `result.isError: true`, the way the SDK's own tool wrapper reports them. Malformed requests, unknown tools or methods, and server faults stay JSON-RPC errors. Adds `-b, --bind` to narrow the listen address. The default still accepts every interface, so this is opt-in hardening. It matters because a request that omits `Authorization` falls back to the server's own token. **Breaking: the HTTP endpoint no longer keeps a session per client.** What changes for a client: 1. `/mcp` accepts `POST` only, and answers `405` to `GET` or `DELETE`. 2. The server neither sends nor accepts `Mcp-Session-Id`, so there is no session handshake to perform. 3. There is no standalone SSE stream and no `Last-Event-ID` resumption. If a response stream breaks, send the whole request again under a new JSON-RPC id. Clients that already speak current streamable HTTP need no changes. Anything relying on the session handshake or the standalone SSE stream should stay on the previous release. --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/227 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
115 lines
3.4 KiB
Go
115 lines
3.4 KiB
Go
package tool
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/modelcontextprotocol/go-sdk/jsonrpc"
|
|
"github.com/modelcontextprotocol/go-sdk/mcp"
|
|
)
|
|
|
|
func callTool(handler Handler, arguments json.RawMessage) (*mcp.CallToolResult, error) {
|
|
serverTool := ServerTool{Tool: &mcp.Tool{Name: "example"}, Handler: handler}
|
|
return serverTool.MCPHandler()(context.Background(), &mcp.CallToolRequest{
|
|
Params: &mcp.CallToolParamsRaw{Arguments: arguments},
|
|
})
|
|
}
|
|
|
|
func captureArguments(into *map[string]any) Handler {
|
|
return func(_ context.Context, arguments map[string]any) (*mcp.CallToolResult, error) {
|
|
*into = arguments
|
|
return &mcp.CallToolResult{}, nil
|
|
}
|
|
}
|
|
|
|
func TestMCPHandler(t *testing.T) {
|
|
var got map[string]any
|
|
result, err := callTool(captureArguments(&got), json.RawMessage(`{"count":2,"nested":{"enabled":true}}`))
|
|
if err != nil {
|
|
t.Fatalf("MCPHandler() error = %v", err)
|
|
}
|
|
if result == nil {
|
|
t.Fatal("MCPHandler() result is nil")
|
|
}
|
|
if got["count"] != float64(2) {
|
|
t.Errorf("count type/value = %T(%v), want float64(2)", got["count"], got["count"])
|
|
}
|
|
}
|
|
|
|
func TestMCPHandlerRejectsInvalidArguments(t *testing.T) {
|
|
called := false
|
|
handler := func(context.Context, map[string]any) (*mcp.CallToolResult, error) {
|
|
called = true
|
|
return &mcp.CallToolResult{}, nil
|
|
}
|
|
|
|
for _, arguments := range []json.RawMessage{json.RawMessage(`[]`), json.RawMessage(`"text"`), json.RawMessage(`{"broken"`)} {
|
|
_, err := callTool(handler, arguments)
|
|
assertProtocolErrorCode(t, err, jsonrpc.CodeInvalidParams)
|
|
}
|
|
if called {
|
|
t.Fatal("handler was called with invalid arguments")
|
|
}
|
|
}
|
|
|
|
// Tools without parameters are callable with an omitted or null "arguments",
|
|
// which is what clients send and what mcp-go accepted before the SDK migration.
|
|
func TestMCPHandlerAcceptsAbsentArguments(t *testing.T) {
|
|
for _, arguments := range []json.RawMessage{nil, json.RawMessage(`null`)} {
|
|
var got map[string]any
|
|
if _, err := callTool(captureArguments(&got), arguments); err != nil {
|
|
t.Fatalf("MCPHandler() with arguments %s error = %v", arguments, err)
|
|
}
|
|
if got == nil || len(got) != 0 {
|
|
t.Errorf("arguments = %#v, want an empty map", got)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestMCPHandlerErrorClassification(t *testing.T) {
|
|
for _, test := range []struct {
|
|
name string
|
|
handler Handler
|
|
wantCode int64
|
|
}{
|
|
{
|
|
name: "server error",
|
|
handler: func(context.Context, map[string]any) (*mcp.CallToolResult, error) { return nil, errors.New("failed") },
|
|
wantCode: jsonrpc.CodeInternalError,
|
|
},
|
|
{
|
|
name: "protocol error",
|
|
handler: func(context.Context, map[string]any) (*mcp.CallToolResult, error) {
|
|
return nil, &jsonrpc.Error{Code: jsonrpc.CodeInvalidParams, Message: "failed"}
|
|
},
|
|
wantCode: jsonrpc.CodeInvalidParams,
|
|
},
|
|
{
|
|
name: "panic",
|
|
handler: func(context.Context, map[string]any) (*mcp.CallToolResult, error) { panic("failed") },
|
|
wantCode: jsonrpc.CodeInternalError,
|
|
},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
result, err := callTool(test.handler, nil)
|
|
if result != nil {
|
|
t.Errorf("result = %#v, want nil", result)
|
|
}
|
|
assertProtocolErrorCode(t, err, test.wantCode)
|
|
})
|
|
}
|
|
}
|
|
|
|
func assertProtocolErrorCode(t *testing.T, err error, want int64) {
|
|
t.Helper()
|
|
var protocolErr *jsonrpc.Error
|
|
if !errors.As(err, &protocolErr) {
|
|
t.Fatalf("error = %v, want *jsonrpc.Error", err)
|
|
}
|
|
if protocolErr.Code != want {
|
|
t.Errorf("error code = %d, want %d", protocolErr.Code, want)
|
|
}
|
|
}
|