Namespace Nexus\Mcp\Server\Transport\Http

Composes PSR-15 middleware in front of an inner request handler, typically the Streamable HTTP transport. The middleware run outermost-first. The pipeline is re-entrant: one instance serves concurrent requests, since each handle() recurses over a fresh immutable tail rather than mutating shared state.

Serves this MCP server's Protected Resource Metadata document, the record a client reads to learn which authorization servers issue tokens for it. Route it at both /.well-known/oauth-protected-resource{/path} and /.well-known/oauth-protected-resource, and name the same URL in BearerAuthenticationMiddleware's challenges. Any other path is answered 404.

Wraps an inner handler (typically the Streamable HTTP transport) with the recommended security middleware, ordered CORS, then DNS-rebinding protection, then Mcp-Param-{Name} validation, then the optional body-size cap. Origin allow-listing is required. Host allow-listing, bearer authentication, parameter-header validation, and the body-size cap apply only when configured. A server whose tools declare x-mcp-header must pass its tool store so the spec-required header-to-body validation runs.

How the Streamable HTTP transport answers a POST that dispatches to a handler.