p-szucs opened a new pull request, #8881:
URL: https://github.com/apache/hadoop/pull/8881
<!--
Thanks for sending a pull request!
1. If this is your first time, please read our contributor guidelines:
https://cwiki.apache.org/confluence/display/HADOOP/How+To+Contribute
2. Make sure your PR title starts with JIRA issue id, e.g.,
'HADOOP-17799. Your PR title ...'.
-->
### Description of PR
Complete MCP 2025-06-18 spec compliance in org.apache.hadoop.mcp
(hadoop-common).
[YARN-11977](https://issues.apache.org/jira/browse/YARN-11977) delivers the
minimal HTTP/JSON-RPC framework and JSON-RPC envelope validation. This task
adds the remaining protocol-level requirements: session lifecycle, duplicate
request ID handling, Streamable HTTP transport checks, and tool security
controls.
Specification details:
https://modelcontextprotocol.io/specification/2025-06-18/basic
**Scope**
1. **MCP session lifecycle management**
Create server-side session state on initialize
Return Mcp-Session-Id on initialize responses (spec header name)
Require a valid, initialized session for operational methods (tools/list,
tools/call, etc.)
Enforce lifecycle ordering:
initialize → notifications/initialized → operation phase
Reject or block requests that skip lifecycle (e.g. tools/* before init)
Implement session idle TTL and expired-session handling (HTTP 404 per
transport spec)
Handle ping per lifecycle/transport rules (allowed without full session
where spec requires)
2. **Duplicate request ID rejection per session**
Track used JSON-RPC request id values per Mcp-Session-Id session
Reject reuse of the same request ID within a session with an appropriate
JSON-RPC error
Clear or scope ID tracking correctly on session expiry
3. **Streamable HTTP transport validation**
Validate incoming HTTP requests per [Streamable
HTTP](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#sending-messages-to-the-server):
Origin header validation (where required by spec)
Mcp-Session-Id required on post-init requests (except initialize / ping
exemptions)
MCP-Protocol-Version header handling
Correct HTTP status codes for notifications (202), unknown/expired session
(404), unsupported methods (405), etc.
4. **Tool output sanitization and rate limiting**
Per [tool security
considerations](https://modelcontextprotocol.io/specification/2025-06-18/server/tools#security-considerations):
Rate-limit tools/call invocations (per session or per connection — document
choice)
Sanitize tool outputs before returning to clients (size limits, unsafe
content handling as appropriate)
Contains content generated by Claude Code
### How was this patch tested?
Unit tests
Deployed on a YARN cluster and verified with Cursor and Claude clients that
they can connect and use the YARN MCP server
### For code changes:
- [x] Does the title of this PR start with the corresponding JIRA issue id
(e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: Have the integration tests been executed and the
endpoint
declared according to the connector-specific documentation? *Note:
Automated CI
testing doesn't cover all cases so manual testing with cloud storage
is still
required.*
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`,
`NOTICE-binary` files?
### AI Tooling
If an AI tool was used:
- [x] The PR includes the phrase "Contains content generated by <tool>"
where <tool> is the name of the AI tool used.
- [x] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
