McpAuthMiddleware
Bearer-token auth for the MCP HTTP endpoint.
Registered by McpPlugin immediately before McpEndpointMiddleware — only when the “http” transport is enabled and mcp.auth isn’t 'none' — so an invalid/missing token never reaches the SDK server at all. The actual validation is delegated to a McpAuthenticatorInterface resolved from the DI container (default: StaticTokenAuthenticator), so an app can swap in its own credential store via PluginRegistrar::service().
Synopsis
Section titled “Synopsis”final class McpAuthMiddleware implements MiddlewareInterface
| Implements | MiddlewareInterface |
| Source | Middleware/McpAuthMiddleware.php |
Constructor
Section titled “Constructor”__construct()
Section titled “__construct()”public function __construct(string $contextName): mixed
| Parameter | Type | Description |
|---|---|---|
$contextName | string |
Returns mixed
Methods
Section titled “Methods”| Method | Description |
|---|---|
process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface | Rejects requests to the MCP path that carry no valid bearer token. |
process()
Section titled “process()”public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
Rejects requests to the MCP path that carry no valid bearer token.
Passes the request straight down the pipeline when MCP is disabled, when mcp.auth is 'none', or when the path is not the configured mcp.path. Otherwise the Authorization header’s Bearer credential is handed to the container-resolved McpAuthenticatorInterface; a missing, empty or rejected token yields a 401 problem-details response carrying WWW-Authenticate: Bearer, and the inner handler is never called.
| Parameter | Type | Description |
|---|---|---|
$request | ServerRequestInterface | |
$handler | RequestHandlerInterface |
Returns ResponseInterface