`McpAction`

Rasuvaeff\Yii3Mcp\McpAction

Class — Rasuvaeff\Yii3Mcp — Source

PSR-15 endpoint serving the MCP Streamable HTTP transport. Route it behind SharedSecretMiddleware (or a network ACL) — the endpoint is trusted-only.

When both a resolved client id (SharedSecretMiddleware upstream) and a $sessionStore are present, sessions are BOUND to the client that created them: the owner is stamped into the session at initialize, immutably, and every subsequent POST/DELETE carrying an Mcp-Session-Id is verified against it BEFORE the transport runs. A request presenting another client's session id — or a session with no recorded owner — is answered with the same 404 the SDK uses for a missing session, indistinguishable from an expired one. The SDK itself only checks that the session UUID exists, so without this guard any authenticated client could act inside (or DELETE) another client's session by replaying its id.

The SDK's DNS-rebinding protection allows only localhost by default; production deployments behind a real domain list it in $allowedHosts.

Methods

handle()

php

handle(
    Psr\Http\Message\ServerRequestInterface $request,
): Psr\Http\Message\ResponseInterface

McpAction ​

Methods ​

handle() ​

`McpAction`

Methods

handle()