StreamableHttpServerConfig class - mcp_host library

Constructors

StreamableHttpServerConfig({String endpoint = '/mcp', String host = 'localhost', int port = 8080, List<int> fallbackPorts = const [8081, 8082, 8083], CorsConfig corsConfig = const CorsConfig(), int maxRequestSize = 4 * 1024 * 1024, Duration requestTimeout = const Duration(seconds: 30), bool isJsonResponseEnabled = false, String jsonResponseMode = 'sync', String? authToken, bool enableGetStream = true, List<String>? allowedOrigins, String? challengeScope, bool allowAnyOrigin = false, bool enableStateless = false, Set<String> supportedProtocolVersions = const {McpProtocol.v2026_07_28}}): const

Properties

allowAnyOrigin → bool: Disables Origin checking entirely.
final
allowedOrigins → List<String>?: Allowed Origin header values for DNS-rebinding protection (MCP 2025-11-25 requires HTTP 403 Forbidden for invalid Origin headers on the Streamable HTTP transport).
final
authToken → String?: Authentication token for Bearer token validation (optional)
final
challengeScope → String?: Space-delimited OAuth scope advertised on the WWW-Authenticate challenge emitted with a 401 Unauthorized (MCP 2025-11-25 incremental scope consent / step-up, SEP-835). When non-null AND OAuth Protected Resource metadata is configured (Server.configureProtectedResource), the challenge carries scope="<value>" so the client knows which scopes to request when (re-)authorizing. Omitted (per spec) when null — the required scope is then "unknown" and not advertised. Backward compatible: no effect unless PRM is configured and a 401 is emitted.
final
corsConfig → CorsConfig: CORS configuration
final
enableGetStream → bool: Enable GET stream for out-of-band server-initiated messages (per MCP 2025-03-26) When false, server returns 405 Method Not Allowed for GET requests
final
enableStateless → bool: Opt-in for the 2026-07-28 stateless core (SEP-2577). Default false: 2026-07-28 is neither served nor advertised, and a request carrying MCP-Protocol-Version: 2026-07-28 is rejected with an UnsupportedProtocolVersionError (JSON-RPC -32022, HTTP 400) — so there is ZERO behavior change from prior deployments.
final
endpoint → String: The endpoint path for StreamableHTTP requests
final
fallbackPorts → List<int>: Fallback ports to try if the primary port is unavailable
final
hashCode → int: The hash code for this object.
no setterinherited
host → String: The host to bind to
final
isJsonResponseEnabled → bool: Enable JSON response mode instead of SSE (default: false for streaming)
final
jsonResponseMode → String: Response mode for JSON: 'sync' or 'async'
final
maxRequestSize → int: Maximum request body size in bytes
final
port → int: The port to listen on
final
requestTimeout → Duration: Request timeout
final
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited
supportedProtocolVersions → Set<String>: Revisions the stateless branch accepts. A request naming anything else is answered with the supported list so the client can retry.
final

Methods

noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
toString() → String: A string representation of this object.
inherited

Operators

operator ==(Object other) → bool: The equality operator.
inherited