TTMSMCPStreamableHTTPTransport Class
Message channel that serves clients over HTTP on a single endpoint, with sessions and optional server-initiated streaming.
API unit family: TMS.MCP.Transport.StreamableHTTP
Inherits from: TTMSMCPTransport
Syntax
TTMSMCPStreamableHTTPTransport = class(TTMSMCPTransport)
Remarks
This is the current HTTP channel and the one to prefer. Everything goes to one address: a client posts a request there and normally gets the answer back in the same response, and may additionally open a long-lived stream on the same address to receive messages the server starts on its own. That is what separates it from the older two-endpoint arrangement (TTMSMCPSseTransport), which it supersedes. It is the only channel with real sessions. A client that completes the handshake is given a session identifier to send with every later request; a session that goes unused for longer than TTMSMCPStreamableHTTPTransport.SessionTimeoutMs is purged, which discards the values and user data stored against it as well as any resources, prompts and subscriptions that belonged to it alone. Newer stateless requests carry no session at all and are answered without creating one. Two independent checks guard the endpoint. Every request to it must come from an origin that is absent, localhost or 127.0.0.1; anything else is refused with 403, and there is no property that widens that set - put a reverse proxy in front of the channel when it has to be reachable from elsewhere. Separately, and only when TTMSMCPStreamableHTTPTransport.RequireBearerAuthentication is on, a request must also carry an access token that the application accepts. Requests are served on the underlying server's own threads and several may run at once, so handlers must be safe to run concurrently. Three worker threads of its own write queued events, keep open streams alive, and purge idle sessions.
Properties
| Name | Description |
|---|---|
| AuthorizationServers | Addresses of the authorization servers whose tokens are accepted, as published in the metadata document. Empty by default. |
| CORSMaxAgeSeconds | How long a browser may reuse the result of one preflight check, in seconds. Defaults to 86400. |
| CertFile | Certificate the listener serves encrypted connections with. |
| CleanupIntervalMs | How often idle sessions are looked for, in milliseconds. Defaults to 60000. |
| EnableOAuthDiscovery | Whether the channel answers the well-known authorization-server discovery addresses. Defaults to False. |
| KeyFile | Path of the private key belonging to the certificate. |
| KeyPassword | Password protecting the private key, when it has one. |
| MCPEndpoint | Path clients address. Defaults to /mcp. |
| OAuthMetadata | Discovery document to serve instead of the one the channel would build. nil by default. |
| Port | Port the channel listens on. Defaults to 8934. |
| ProtectedResourceMetadata | Protected-resource metadata document to serve instead of the one the channel would build. nil by default. |
| PublicHost | Address clients reach the channel by, when that differs from where it listens. Empty by default. |
| RequireBearerAuthentication | Whether a request to the protocol endpoint must carry an accepted access token. Defaults to False. |
| RequiredScopes | Scopes a token must grant before a request is allowed through. Empty by default. |
| ResourceScopesSupported | Scopes the endpoint understands, as published in the metadata document. Empty by default. |
| SessionTimeoutMs | How long a session may go unused before it is purged, in milliseconds. Defaults to 300000. |
| UseSSL | Whether the listener serves encrypted connections. Defaults to False. |
Methods
| Name | Description |
|---|---|
| ActiveSessionIds | Returns the identifiers of the sessions that are currently open. |
| BroadcastNotification | Pushes a server-initiated notification to every open session. |
| ConfigureSSL | Turns on encryption and records the certificate to serve it with. |
| DisableSSL | Turns off encryption and clears the recorded certificate settings. |
| GetServerUrl | Returns the base address the channel should be addressed by. |
| IsSSLConfigured | Reports whether encryption is switched on and a certificate has been named. |
| ProcessMessages | Does nothing on this channel. |
| Run | Starts the channel if needed and parks the calling thread until it stops. |
| SendNotificationToSession | Pushes a server-initiated notification to one session. |
| SendRequestToSession | Tries to push a server-initiated request to one session over its open stream. |
| SessionCount | Returns how many sessions are currently open. |
| Start | Opens the listening port and starts the worker threads. |
| Stop | Closes the listening port, ends every session and stops the worker threads. |
Events
| Name | Description |
|---|---|
| OnGetCustomHeader | Handler that inspects each incoming request and may reject it. |
| OnLog | Handler receiving the channel's progress and diagnostic lines. |
| OnSetCustomHeader | Handler that adds headers to an outgoing answer. |
| OnValidateAccessToken | Handler that decides whether a presented access token is accepted and what it grants. |