Activity

1. CodeWithKyrian commented on Jul 9, 2025

   

   CodeWithKyrian

   on Jul 9, 2025

   Contributor

   More actions

   Hey Marco,

   Thanks for reaching out! Great question, and yeah, proper OAuth support is definitely on the roadmap.

   I actually have a plan mapped out for it already. The goal is to make it flexible enough so you’re not tied to any specific OAuth library. The main blocker right now is a dependency conflict between reactphp/http (which the library uses) and popular OAuth packages like league/oauth2-server(#23), but I’m working on getting that sorted.

   That said, the first step which I think covers exactly your use case is to add simple token validation support. The idea is you’d be able to configure the server like this:

   $server = Server::make()
       ->withAuthorization(
           enabled: true,
           tokenValidator: new MyCustomTokenValidator()
       );

   Your custom validator would get the bearer token straight from the Authorization header, and from there you can plug in whatever validation logic you need like external services, database checks, anything really.

   This way, you can handle the basic validation flow without going for full OAuth integration. Still working on the specifics but it's coming, soon!

   Appreciate you bringing this up. Cheers!
2. sergioalborada commented on Jul 11, 2025

   

   sergioalborada

   on Jul 11, 2025

   More actions

   Hi,

   Correct me if I am wrong:

   The headers (including authorization) should be available within tool implementations because clients send the headers on each post request (not sure though if that assumption is right, haven't worked with MCP enough yet). If the headers are only sent on the initial request, then, the server should have a built in mechanism to retrieve the original request data.

   Assumin the first, if you want to get a bearer token, this would work within a tool call:

   function getBearerToken(): ?string {
       if (function_exists('getallheaders')) {
           $headers = getallheaders();
           if (isset($headers['Authorization']) && str_starts_with($headers['Authorization'], 'Bearer ')) {
               return substr($headers['Authorization'], 7);
           }
       }
   
       $auth = $_SERVER['HTTP_AUTHORIZATION'] ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? null;
   
       if ($auth && str_starts_with($auth, 'Bearer ')) {
           return substr($auth, 7);
       }
   
       return null;
   }
   

   Besides, I think you could also use this if you you want more fine grained controls over the tool call.

   Using the laravel wrapper, I have been able to retrieve the current user wthin a tool call by using the sanctum middleware and a personal access token, so I assume that the headers are sent on each request (it wouldn't work otherwise), but I have only tried it using mcp inspector and the legacy SSE transport, so, there could be differences.
3. ilvalerione commented on Sep 4, 2025

   

   ilvalerione

   on Sep 4, 2025

   More actions

   What happened to the Context class introduce by @marcod85 in #50 ?
4. vielhuber commented on Sep 16, 2025

   

   vielhuber

   on Sep 16, 2025

   More actions

   When does the current main branch be released? The middleware feature seems quite important in this scenario.