Uh oh!
There was an error while loading. Please reload this page.
feat: serve over streamable HTTP with per-request credentials - #38
feat: serve over streamable HTTP with per-request credentials#38zvikagart wants to merge 3 commits into
Conversation
Add a --transport streamable-http mode that serves many users from one process, resolving the Code Ocean client from each request's 'Authorization: Bearer <token>' header via a request-scoped client proxy, so the tool definitions stay untouched. Requests without a token are refused rather than served with the environment's token. The stdio transport with CODEOCEAN_TOKEN remains the default and is unchanged.
There was a problem hiding this comment.
Pull request overview
Adds a new streamable-HTTP transport option so a single codeocean-mcp-server process can serve multiple callers, resolving Code Ocean credentials per request from the HTTP Authorization header while keeping the existing stdio behavior unchanged.
Changes:
- Introduces
--transport streamable-http(plus--host/--port) and runs FastMCP in stateless HTTP mode. - Adds a request-scoped
CodeOceanclient proxy with an LRU cache to reuse connection pools per token. - Adds end-to-end tests for per-request credential isolation and updates README usage docs.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
tests/test_http_transport.py | Adds E2E coverage for streamable-HTTP, per-request tokens, and tool parity with stdio. |
src/codeocean_mcp_server/server.py | Adds CLI parsing and wires streamable-HTTP transport + request-scoped client behavior. |
src/codeocean_mcp_server/client.py | Implements per-request token extraction and cached client creation. |
README.md | Documents how to run and call the server over streamable HTTP. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Rewrite the Authorization header parse as an explicit scheme guard - the conditional expression it replaces read as if the scheme check could be skipped, and a test now covers a token offered under a non-Bearer scheme. Report only the variables actually required for the chosen transport, so streamable-HTTP no longer claims CODEOCEAN_TOKEN must be set.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Lets a single server process serve many users, so callers (notably the Code Ocean agent) can run one shared server instead of spawning one subprocess per invocation.
Changes
--transport streamable-httpmode (with--host/--port), served withstateless_http=True.stdioremains the default; running the server with onlyCODEOCEAN_TOKENandCODEOCEAN_DOMAINexported from Claude Desktop or Cursor is unchanged.CodeOceanclient is now resolved per request in HTTP mode, from the request'sAuthorization: Bearerheader, via a request-scoped proxy. Tools keep closing over a singleclientobject, so all 26 tool definitions, their names, input schemas and descriptions are untouched.