Skip to content

Conversation

Kehrlann
Copy link
Contributor

@Kehrlann Kehrlann commented Jul 11, 2025

When using an MCP sync server, in a servlet environment, use SyncSpecification#immediateExecution(true), introduced in modelcontextprotocol/java-sdk#371 .

This allows to propagate thread-locals to the @Tool method; granting access to e.g. Framework's RequestContextHolder#getRequestAttributes() or Security's SecurityContextHolder#getContext().

This, in turn, allows users to use Spring Security's method-level security, e.g.:

@PreAuthorize("hasScope('widget.read')") @Tool(description = "...") public Widget getWidget(...) { // ... } @PreAuthorize("hasScope('widget.admin')") @Tool(description = "...") public Widget addWidget(...) { // ... }
@tzolov tzolov self-assigned this Jul 11, 2025
@tzolov tzolov added this to the 1.1.x milestone Jul 11, 2025
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
@Kehrlann Kehrlann force-pushed the dgarnier/mcp-sync-server-servlet-execution branch from 0064869 to c3dc91d Compare August 4, 2025 11:52
@markpollack
Copy link
Member

merged in 568ca96

@markpollack markpollack closed this Aug 8, 2025
@markpollack markpollack assigned markpollack and unassigned tzolov Aug 8, 2025
@markpollack markpollack added the MCP label Aug 8, 2025
@Kehrlann Kehrlann deleted the dgarnier/mcp-sync-server-servlet-execution branch September 15, 2025 19:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3 participants