Package com.xebialabs.xlrelease.mcp.oauth

Class McpProtectedResourceMetadataServlet

java.lang.Object
jakarta.servlet.GenericServlet
jakarta.servlet.http.HttpServlet
com.xebialabs.xlrelease.mcp.oauth.McpProtectedResourceMetadataServlet
All Implemented Interfaces:
jakarta.servlet.Servlet, jakarta.servlet.ServletConfig, Serializable
public class McpProtectedResourceMetadataServlet extends jakarta.servlet.http.HttpServlet
Serves the OAuth 2.0 Protected Resource Metadata (RFC 9728) for the MCP endpoint, so MCP clients (Claude, etc.) can discover the OIDC authorization server protecting /s/mcp and run the OAuth 2.1 + PKCE flow on their own. Mounted at /.well-known/oauth-protected-resource and /.well-known/oauth-protected-resource/*; only the bare path and the MCP resource path suffix (e.g. /s/mcp) are answered, anything else is 404.

Answers 404 while the MCP server feature is disabled (mirroring McpServerEnabledFilter) or when no OIDC issuer is configured. Purely additive: it never affects which credentials the MCP endpoint accepts.

See Also:

  • Field Summary

    Fields inherited from class jakarta.servlet.http.HttpServlet

    LEGACY_DO_HEAD

  • Constructor Summary

    Constructors
    Constructor
    Description
    McpProtectedResourceMetadataServlet(Supplier<String> serverUrl, String mcpResourcePath, Supplier<String> issuer, BooleanSupplier mcpServerEnabled, List<String> scopesSupported)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static String
    baseUrl(String serverUrl)
    Server base URL without a trailing slash, tolerating the one getServerUrl() carries.
    protected void
    doGet(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
     

    Methods inherited from class jakarta.servlet.http.HttpServlet

    doDelete, doHead, doOptions, doPatch, doPost, doPut, doTrace, getLastModified, init, isSensitiveHeader, service, service

    Methods inherited from class jakarta.servlet.GenericServlet

    destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, init, log, log

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • McpProtectedResourceMetadataServlet

      public McpProtectedResourceMetadataServlet(Supplier<String> serverUrl, String mcpResourcePath, Supplier<String> issuer, BooleanSupplier mcpServerEnabled, List<String> scopesSupported)
      Parameters:
      serverUrl - supplier of the public server base URL (read per request so runtime changes to the configured server URL are reflected immediately)
      mcpResourcePath - the MCP endpoint path relative to the server root, e.g. /s/mcp
      issuer - supplier of the configured OIDC issuer URL (may return null/blank)
      mcpServerEnabled - runtime MCP server feature toggle
      scopesSupported - scopes to advertise as scopes_supported (xl.features.mcp.server.oauth.scopes-supported); MCP clients request exactly these when registering with the OIDC provider instead of guessing from the provider's full scope list. Empty list omits the field.

  • Method Details

    • doGet

      protected void doGet(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response) throws IOException
      Overrides:
      doGet in class jakarta.servlet.http.HttpServlet
      Throws:
      IOException

    • baseUrl

      public static String baseUrl(String serverUrl)
      Server base URL without a trailing slash, tolerating the one getServerUrl() carries.