feature: add MCP custom configuration and authentication code #7876

Xb2555 · 2025-12-19T09:56:40Z

I have read the CONTRIBUTING.md guidelines.
I have registered the PR changes.

Ⅰ. Describe what this PR did

Add configuration file attributes related to MCP
Implement authentication for request paths related to MCP

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

codecov · 2025-12-19T10:21:03Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.12%. Comparing base (4593c46) to head (be1268e).
⚠️ Report is 1 commits behind head on 2.x.

Additional details and impacted files

@@             Coverage Diff              @@
##                2.x    #7876      +/-   ##
============================================
+ Coverage     71.11%   71.12%   +0.01%     
  Complexity      797      797              
============================================
  Files          1300     1300              
  Lines         49601    49601              
  Branches       5875     5875              
============================================
+ Hits          35274    35281       +7     
+ Misses        11406    11403       -3     
+ Partials       2921     2917       -4

see 8 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

xjlgod · 2025-12-20T09:21:32Z

Has the previous MCP-related content been merged, or should we merge this one first?

xjlgod · 2025-12-20T09:22:26Z

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java

    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
-        RequestMatcher[] ignoredMatchers = buildAntMatchers(env.getProperty("seata.security.ignore.urls", "/**"));
+        StringBuilder ignoreURLs = new StringBuilder(env.getProperty("seata.security.ignore.urls", "/**"));


maybe we can use string joiner

I tried before. The path that needs to be ignored directly passed in as a string cannot be configured correctly. It needs to be converted to the RequestMatcher array (it might be a problem with the new version of security).

Copilot

Pull request overview

This PR adds Model Context Protocol (MCP) server support to the Seata console by introducing custom configuration properties and authentication mechanisms for MCP endpoints.

Key Changes:

Added MCP server configuration properties in application.yml including protocol type, endpoints, query duration limits, and authentication settings
Implemented MCPProperties class to manage MCP configuration with support for both SSE and streamable HTTP protocols
Created MCPAuthenticationFilter to handle username/password authentication via custom HTTP headers for MCP endpoints

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
namingserver/src/main/resources/application.yml	Adds MCP server configuration including protocol settings, endpoints, query duration limit, and authentication toggle
console/src/main/java/org/apache/seata/mcp/core/props/MCPProperties.java	New properties class that loads and manages MCP configuration from environment, supporting both SSE and streamable protocols
console/src/main/java/org/apache/seata/console/filter/MCPAuthenticationFilter.java	New authentication filter that extracts credentials from custom headers and validates them using Spring Security
console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java	Updates security configuration to add MCP endpoints to ignore and CSRF ignore lists
console/src/main/java/org/apache/seata/console/config/MCPFiltersConfig.java	Registers the MCP authentication filter and conditionally enables it based on configuration
changes/zh-cn/2.x.md	Documents the feature addition in Chinese changelog
changes/en-us/2.x.md	Documents the feature addition in English changelog

Comments suppressed due to low confidence (1)

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java:117

The MCP endpoints are being added to both the ignore URLs and CSRF ignore URLs. However, there's a logical conflict: if endpoints are in the ignore URLs list (which bypasses all security), they won't reach the MCPAuthenticationFilter that's registered in MCPFiltersConfig. This means authentication will never be enforced for MCP endpoints, even when seata.mcp.auth.enabled is true. Either remove MCP endpoints from the ignore list or reconsider the authentication strategy.

        StringBuilder ignoreURLs = new StringBuilder(env.getProperty("seata.security.ignore.urls", "/**"));
        List<String> mcpEndpoints = mcpProperties.getEndpoints();
        for (String endpoint : mcpEndpoints) {
            ignoreURLs.append(",").append(endpoint);
        }
        RequestMatcher[] ignoredMatchers =
                buildAntMatchers(ignoreURLs.toString().trim());
        return web -> {
            if (ignoredMatchers.length > 0) {
                web.ignoring().requestMatchers(ignoredMatchers);
            }
        };

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

console/src/main/java/org/apache/seata/mcp/core/props/MCPProperties.java

console/src/main/java/org/apache/seata/console/filter/MCPAuthenticationFilter.java

namingserver/src/main/resources/application.yml

console/src/main/java/org/apache/seata/console/filter/MCPAuthenticationFilter.java

console/src/main/java/org/apache/seata/mcp/core/props/MCPProperties.java

…ration

…cp_core

Xb2555 · 2025-12-20T10:08:50Z

Has the previous MCP-related content been merged, or should we merge this one first?

Previously, only the dependencies related to MCP were introduced. Now, this PR introduces the MCP security configuration and custom parameter configuration. It can be directly merged in without any impact.

xjlgod

LGTM

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java

console/src/main/java/org/apache/seata/console/filter/MCPAuthenticationFilter.java

console/src/main/java/org/apache/seata/mcp/core/props/MCPProperties.java

…default value

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

console/src/main/java/org/apache/seata/console/filter/MCPAuthenticationFilter.java

console/src/main/java/org/apache/seata/mcp/core/props/MCPProperties.java

console/src/main/java/org/apache/seata/console/config/MCPFiltersConfig.java

Copilot · 2025-12-23T03:42:20Z

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java

+        StringBuilder ignoreURLsBuilder = new StringBuilder(ignoreURLs);
+        List<String> mcpEndpoints = mcpProperties.getEndpoints();
+        for (String endpoint : mcpEndpoints) {
+            ignoreURLsBuilder.append(",").append(endpoint);
+        }
+        RequestMatcher[] ignoredMatchers =
+                buildAntMatchers(ignoreURLsBuilder.toString().trim());


The MCP endpoints are being added to the security ignore list, which means Spring Security will completely bypass authentication for these endpoints. This conflicts with the purpose of MCPAuthenticationFilter which is meant to authenticate MCP requests. When endpoints are in the ignore list, they never reach any security filters. The MCPAuthenticationFilter registered in MCPFiltersConfig will not be invoked for these URLs. Remove the code that adds MCP endpoints to the ignore list if authentication is required for these endpoints.

Suggested change

StringBuilder ignoreURLsBuilder = new StringBuilder(ignoreURLs);

List<String> mcpEndpoints = mcpProperties.getEndpoints();

for (String endpoint : mcpEndpoints) {

ignoreURLsBuilder.append(",").append(endpoint);

}

RequestMatcher[] ignoredMatchers =

buildAntMatchers(ignoreURLsBuilder.toString().trim());

RequestMatcher[] ignoredMatchers =

buildAntMatchers(ignoreURLs.trim());

console/src/main/java/org/apache/seata/console/config/MCPFiltersConfig.java

console/src/main/java/org/apache/seata/console/filter/MCPAuthenticationFilter.java

…g MCPProperties

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java

console/src/main/java/org/apache/seata/mcp/core/props/MCPProperties.java

funky-eyes

LGTM

…#7876)

Xb2555 added 3 commits December 19, 2025 17:52

optimize: add MCP custom configuration and authentication code

9856b50

optimize: add MCP server name and version

13962e8

optimize: add change

c8e3914

xjlgod requested a review from Copilot December 20, 2025 09:20

Merge branch '2.x' into feature_mcp_core

89b204b

Copilot started reviewing on behalf of xjlgod December 20, 2025 09:20 View session

xjlgod reviewed Dec 20, 2025

View reviewed changes

Copilot AI reviewed Dec 20, 2025

View reviewed changes

Xb2555 added 8 commits December 20, 2025 17:47

fix: handle exceptions to the parseLong operation of the max_query_du…

8efff80

…ration

fix: add checkAfterPropertiesSet method to MCPProperties

124526e

fix: change to catch AuthenticationException

ec0fcda

fix: change to mcpAuthenticationFilterRegistration

ee2d2ff

optimize: add authentication null value judgment

baf08fe

optimize: change mcpEndPoint to mcpEndpoint

8acbadc

optimize: using constructor injection instead

a711709

Merge remote-tracking branch 'origin/feature_mcp_core' into feature_m…

4006604

…cp_core

xjlgod approved these changes Dec 20, 2025

View reviewed changes

Xb2555 added 2 commits December 20, 2025 21:52

Merge branch '2.x' into feature_mcp_core

e396804

Merge branch '2.x' into feature_mcp_core

42a0b7d

funky-eyes reviewed Dec 22, 2025

View reviewed changes

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java Outdated Show resolved Hide resolved

funky-eyes reviewed Dec 22, 2025

View reviewed changes

console/src/main/java/org/apache/seata/console/filter/MCPAuthenticationFilter.java Outdated Show resolved Hide resolved

funky-eyes reviewed Dec 22, 2025

View reviewed changes

console/src/main/java/org/apache/seata/console/filter/MCPAuthenticationFilter.java Outdated Show resolved Hide resolved

console/src/main/java/org/apache/seata/mcp/core/props/MCPProperties.java Outdated Show resolved Hide resolved

Xb2555 added 3 commits December 22, 2025 19:33

optimize: replace the use of env with Value

74b59ed

Merge branch '2.x' into feature_mcp_core

d294cb1

fix: fix an issue where the value annotation was not included in the …

1247c1c

…default value

funky-eyes requested a review from Copilot December 23, 2025 03:26

Copilot started reviewing on behalf of funky-eyes December 23, 2025 03:33 View session

Copilot AI reviewed Dec 23, 2025

View reviewed changes

optimize: reuse the original JWT token validation and use the existin…

92a472c

…g MCPProperties

funky-eyes requested a review from Copilot December 23, 2025 06:30

Copilot started reviewing on behalf of funky-eyes December 23, 2025 06:31 View session

Copilot AI reviewed Dec 23, 2025

View reviewed changes

fix: fix the issue of not using the enableAuth parameter

be1268e

funky-eyes added this to the 2.6.0 milestone Dec 23, 2025

funky-eyes added type: feature Category issues or prs related to feature request. module/namingserver labels Dec 23, 2025

funky-eyes approved these changes Dec 23, 2025

View reviewed changes

funky-eyes added the module/console label Dec 23, 2025

funky-eyes merged commit ece45ac into apache:2.x Dec 23, 2025
11 checks passed

Xb2555 deleted the feature_mcp_core branch December 23, 2025 11:46

YvCeung pushed a commit to YvCeung/incubator-seata that referenced this pull request Dec 25, 2025

feature: add MCP custom configuration and authentication code (apache…

cd7fb99

…#7876)

feature: add MCP custom configuration and authentication code #7876

feature: add MCP custom configuration and authentication code #7876

Uh oh!

Conversation

Xb2555 commented Dec 19, 2025

Ⅰ. Describe what this PR did

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

Uh oh!

codecov bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

xjlgod commented Dec 20, 2025

Uh oh!

xjlgod Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Xb2555 Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Xb2555 commented Dec 20, 2025

Uh oh!

xjlgod left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

funky-eyes left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Dec 19, 2025 •

edited

Loading