mcp

fun Route.mcp(path: String, enableDnsRebindingProtection: Boolean = true, allowedHosts: List<String>? = null, allowedOrigins: List<String>? = null, maxRequestBodySize: Long = DEFAULT_MAX_REQUEST_BODY_SIZE, block: ServerSSESession.() -> Server)(source)

Registers MCP over Server-Sent Events (SSE) Transport at the specified path on this Route.

Precondition: the SSE plugin must be installed on the application before calling this function. Use Application.mcp if you want SSE to be installed automatically.

Parameters

path

the URL path to register the SSE endpoint.

enableDnsRebindingProtection

whether to install DnsRebindingProtection on this route. Defaults to true.

allowedHosts

hostnames allowed in the Host header. Defaults to localhost, 127.0.0.1, [::1].

allowedOrigins

origins allowed in the Origin header, compared by hostname only (scheme and port are ignored). Requests without an Origin header are allowed. When null while the localhost host defaults are in effect (no custom allowedHosts), the Origin header is validated against localhost, 127.0.0.1, [::1]. With custom allowedHosts, null skips origin validation.

maxRequestBodySize

maximum allowed size, in bytes, of an incoming POST body; larger requests are rejected with 413 Payload Too Large. Defaults to 4 MiB.

block

factory block with access to the ServerSSESession that creates and returns the Server to handle the connection.

Throws

if the SSE plugin is not installed.


fun Route.mcp(enableDnsRebindingProtection: Boolean = true, allowedHosts: List<String>? = null, allowedOrigins: List<String>? = null, maxRequestBodySize: Long = DEFAULT_MAX_REQUEST_BODY_SIZE, block: ServerSSESession.() -> Server)(source)

Registers MCP over Server-Sent Events (SSE) Transport endpoints on this Route.

Precondition: the SSE plugin must be installed on the application before calling this function. Use Application.mcp if you want SSE to be installed automatically.

Parameters

enableDnsRebindingProtection

whether to install DnsRebindingProtection on this route. Defaults to true.

allowedHosts

hostnames allowed in the Host header. Defaults to localhost, 127.0.0.1, [::1].

allowedOrigins

origins allowed in the Origin header, compared by hostname only (scheme and port are ignored). Requests without an Origin header are allowed. When null while the localhost host defaults are in effect (no custom allowedHosts), the Origin header is validated against localhost, 127.0.0.1, [::1]. With custom allowedHosts, null skips origin validation.

maxRequestBodySize

maximum allowed size, in bytes, of an incoming POST body; larger requests are rejected with 413 Payload Too Large. Defaults to 4 MiB.

block

factory block with access to the ServerSSESession that creates and returns the Server to handle the connection.

Throws

if the SSE plugin is not installed.


fun Application.mcp(enableDnsRebindingProtection: Boolean = true, allowedHosts: List<String>? = null, allowedOrigins: List<String>? = null, maxRequestBodySize: Long = DEFAULT_MAX_REQUEST_BODY_SIZE, block: ServerSSESession.() -> Server)(source)

Configures the Ktor Application to handle Model Context Protocol (MCP) over Server-Sent Events (SSE) Transport and sets up routing with the provided configuration block.

Automatically installs ContentNegotiation with McpJson and SSE.

Parameters

enableDnsRebindingProtection

whether to install DnsRebindingProtection on this route. Defaults to true.

allowedHosts

hostnames allowed in the Host header. Defaults to localhost, 127.0.0.1, [::1].

allowedOrigins

origins allowed in the Origin header, compared by hostname only (scheme and port are ignored). Requests without an Origin header are allowed. When null while the localhost host defaults are in effect (no custom allowedHosts), the Origin header is validated against localhost, 127.0.0.1, [::1]. With custom allowedHosts, null skips origin validation.

maxRequestBodySize

maximum allowed size, in bytes, of an incoming POST body; larger requests are rejected with 413 Payload Too Large. Defaults to 4 MiB.

block

factory block with access to the ServerSSESession that creates and returns the Server to handle the connection.