Class Nexus\Mcp\Server\Transport\Http\SecuredHttpEndpoint

`final`
`readonly`
`implements`	`RequestHandlerInterface`

Wraps an inner handler (typically the Streamable HTTP transport) with the recommended security middleware, ordered CORS, then DNS-rebinding protection, then Mcp-Param-{Name} validation, then the optional body-size cap. Origin allow-listing is required. Host allow-listing, bearer authentication, parameter-header validation, and the body-size cap apply only when configured. A server whose tools declare x-mcp-header must pass its tool store so the spec-required header-to-body validation runs.

Located at Server/Transport/Http/SecuredHttpEndpoint.php

Methods


					
	public

__construct(
	RequestHandlerInterface $handler,
	list<non-empty-string> $allowedOrigins,
	ResponseFactoryInterface $responseFactory,
	StreamFactoryInterface $streamFactory,
	list<non-empty-string> $allowedHosts = [],
	null|int $maxBodyBytes = null,
	null|ToolStoreInterface $toolStore = null,
	LoggerInterface $logger = new NullLogger(),
	null|MiddlewareInterface $authentication = null,
)

Parameters

`$allowedOrigins`	Origins permitted to reach the endpoint, or `['*']` to allow any
`$allowedHosts`	Hosts permitted to reach the endpoint (empty disables `Host` validation), or `['*']` to allow any
`$maxBodyBytes`	Request body byte cap, or `null` to leave the body uncapped
`$toolStore`	The served tool store, enabling `Mcp-Param-{Name}` validation
`$authentication`	Bearer token enforcement, making the endpoint an OAuth resource server


					
	public

handle(ServerRequestInterface $request): ResponseInterface

Namespaces

Classes

Enums

Class Nexus\Mcp\Server\Transport\Http\SecuredHttpEndpoint

Parameters