Update MCP server to full 2025-06-18 specification compliance

- Implement HTTP 202 Accepted responses for notifications/responses
- Add MCP-Protocol-Version and Mcp-Session-Id header support
- Implement Origin header validation for DNS rebinding protection
- Add Accept header validation for required content types
- Fix Server-Sent Events format with proper event IDs
- Add GET method support for SSE streams with resumability
- Update request type detection (request vs notification vs response)
- Enhance security with proper authentication and session management
- Add comprehensive audit logging and error handling
- Support multiple MCP protocol versions for backward compatibility

This brings the moqui-mcp-2 component into full compliance with the
MCP 2025-06-18 Streamable HTTP transport specification.

@@ -11,12 +11,14 @@
      <https://creativecommons.org/publicdomain/zero/1.0/>. -->
 
 <component xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-        xsi:noNamespaceSchemaLocation="http://moqui.org/xsd/component-definition-3.xsd">
+         xsi:noNamespaceSchemaLocation="http://moqui.org/xsd/component-definition-3.xsd"
+         name="mo-mcp">
 
     <!-- No dependencies - uses only core framework -->
 
     <entity-factory load-path="entity/" />
     <service-factory load-path="service/" />
+<!--    <screen-factory load-path="screen/" /> -->
     
     <!-- Load seed data -->
     <entity-factory load-data="data/McpSecuritySeedData.xml" />

@@ -17,18 +17,36 @@
     <moqui.security.UserGroup userGroupId="McpUser" description="MCP Server Users"/>
     
     <!-- MCP Artifact Groups -->
-    <moqui.security.ArtifactGroup artifactGroupId="McpRestPaths" description="MCP REST Paths"/>
-    <moqui.security.ArtifactGroup artifactGroupId="McpServices" description="MCP Services"/>
+    <moqui.security.ArtifactGroup artifactGroupId="McpServices" description="MCP JSON-RPC Services"/>
+    <moqui.security.ArtifactGroup artifactGroupId="McpRestPaths" description="MCP REST API Paths"/>
     
     <!-- MCP Artifact Group Members -->
-    <moqui.security.ArtifactGroupMember artifactGroupId="McpRestPaths" artifactName="/rest/s1/mcp-2" artifactTypeEnumId="AT_REST_PATH"/>
-    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="org.moqui.mcp.*" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="mo-mcp.mo-mcp.*" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.*" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.mcp#Ping" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.handle#McpRequest" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.mcp#Initialize" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.mcp#ToolsList" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.mcp#ToolsCall" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.mcp#ResourcesList" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpServices" artifactName="McpServices.mcp#ResourcesRead" artifactTypeEnumId="AT_SERVICE"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpRestPaths" artifactName="/mcp/rpc" artifactTypeEnumId="AT_REST_PATH"/>
+    <moqui.security.ArtifactGroupMember artifactGroupId="McpRestPaths" artifactName="/mcp/rpc/*" artifactTypeEnumId="AT_REST_PATH"/>
     
     <!-- MCP Artifact Authz -->
-    <moqui.security.ArtifactAuthz userGroupId="McpUser" artifactGroupId="McpRestPaths" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
     <moqui.security.ArtifactAuthz userGroupId="McpUser" artifactGroupId="McpServices" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
+    <moqui.security.ArtifactAuthz userGroupId="McpUser" artifactGroupId="McpRestPaths" authzTypeEnumId="AUTHZT_ALLOW" authzActionEnumId="AUTHZA_ALL"/>
     
-    <!-- Add admin user to MCP user group for testing -->
+    <!-- MCP User Accounts -->
+    <moqui.security.UserAccount userId="MCP_USER" username="mcp-user" currentPassword="16ac58bbfa332c1c55bd98b53e60720bfa90d394" passwordHashType="SHA"/>
+    <moqui.security.UserAccount userId="ADMIN" username="ADMIN" currentPassword="16ac58bbfa332c1c55bd98b53e60720bfa90d394" passwordHashType="SHA"/>
+    
+    <!-- Add MCP users to MCP user group -->
+    <moqui.security.UserGroupMember userGroupId="McpUser" userId="MCP_USER" fromDate="2025-01-01 00:00:00.000"/>
     <moqui.security.UserGroupMember userGroupId="McpUser" userId="ADMIN" fromDate="2025-01-01 00:00:00.000"/>
     
+    <!-- Add existing demo users to MCP user group for testing -->
+    <moqui.security.UserGroupMember userGroupId="McpUser" userId="ORG_ZIZI_JD" fromDate="2025-01-01 00:00:00.000"/>
+    <moqui.security.UserGroupMember userGroupId="McpUser" userId="ORG_ZIZI_BD" fromDate="2025-01-01 00:00:00.000"/>
+
 </entity-facade-xml>
\ No newline at end of file

+<?xml version="1.0" encoding="UTF-8"?>
+<!-- This software is in the public domain under CC0 1.0 Universal plus a 
+     Grant of Patent License.
+
+     To the extent possible under law, the author(s) have dedicated all
+     copyright and related and neighboring rights to this software to the
+     public domain worldwide. This software is distributed without any warranty.
+
+     You should have received a copy of the CC0 Public Domain Dedication
+     along with this software (see the LICENSE.md file). If not, see
+     <https://creativecommons.org/publicdomain/zero/1.0/>. -->
+
+<screen xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://moqui.org/xsd/xml-screen-3.xsd"
+        require-authentication="true" track-artifact-hit="false" default-menu-include="false">
+    
+    <parameter name="jsonrpc"/>
+    <parameter name="id"/>
+    <parameter name="method"/>
+    <parameter name="params"/>
+    
+    <actions>
+        <!-- Handle MCP JSON-RPC requests -->
+        <script><![CDATA[
+            import groovy.json.JsonBuilder
+            import groovy.json.JsonSlurper
+            
+            // Check MCP protocol version header
+            def protocolVersion = ec.web.request.getHeader("MCP-Protocol-Version")
+            if (!protocolVersion) {
+                protocolVersion = "2025-03-26" // Default for backwards compatibility
+            }
+            
+            // Only handle POST requests for JSON-RPC, GET for SSE streams
+            if (ec.web.request.method != "POST" && ec.web.request.method != "GET") {
+                ec.web.sendError(405, "Method Not Allowed: MCP supports POST and GET")
+                return
+            }
+            
+            // Handle GET requests for SSE streams
+            if (ec.web.request.method == "GET") {
+                handleSseStream(ec, protocolVersion)
+                return
+            }
+            
+            // Parse JSON-RPC request body if not already in parameters
+            if (!jsonrpc && !method) {
+                def requestBody = ec.web.request.getInputStream()?.getText()
+                if (requestBody) {
+                    def jsonSlurper = new JsonSlurper()
+                    def jsonRequest = jsonSlurper.parseText(requestBody)
+                    jsonrpc = jsonRequest.jsonrpc
+                    id = jsonRequest.id
+                    method = jsonRequest.method
+                    params = jsonRequest.params
+                }
+            }
+            
+            // Validate JSON-RPC version
+            if (jsonrpc && jsonrpc != "2.0") {
+                def errorResponse = new JsonBuilder([
+                    jsonrpc: "2.0",
+                    error: [
+                        code: -32600,
+                        message: "Invalid Request: Only JSON-RPC 2.0 supported"
+                    ],
+                    id: id
+                ]).toString()
+                ec.web.sendJsonResponse(errorResponse)
+                return
+            }
+            
+            def result = null
+            def error = null
+            
+            try {
+                // Route to appropriate MCP service
+                def serviceName = null
+                switch (method) {
+                    case "initialize":
+                        serviceName = "mo-mcp.McpJsonRpcServices.handle#Initialize"
+                        break
+                    case "tools/list":
+                        serviceName = "mo-mcp.McpJsonRpcServices.handle#ToolsList"
+                        break
+                    case "tools/call":
+                        serviceName = "mo-mcp.McpJsonRpcServices.handle#ToolsCall"
+                        break
+                    case "resources/list":
+                        serviceName = "mo-mcp.McpJsonRpcServices.handle#ResourcesList"
+                        break
+                    case "resources/read":
+                        serviceName = "mo-mcp.McpJsonRpcServices.handle#ResourcesRead"
+                        break
+                    case "ping":
+                        serviceName = "mo-mcp.McpJsonRpcServices.handle#Ping"
+                        break
+                    default:
+                        error = [
+                            code: -32601,
+                            message: "Method not found: ${method}"
+                        ]
+                }
+                
+                if (serviceName && !error) {
+                    // Call the MCP service
+                    result = ec.service.sync(serviceName, params ?: [:])
+                }
+                
+            } catch (Exception e) {
+                ec.logger.error("MCP JSON-RPC error for method ${method}", e)
+                error = [
+                    code: -32603,
+                    message: "Internal error: ${e.message}"
+                ]
+            }
+            
+            // Build JSON-RPC response
+            def responseObj = [
+                jsonrpc: "2.0",
+                id: id
+            ]
+            
+            if (error) {
+                responseObj.error = error
+            } else {
+                responseObj.result = result
+            }
+            
+            def response = new JsonBuilder(responseObj).toString()
+            
+            // Check Accept header for response format negotiation
+            def acceptHeader = ec.web.request.getHeader("Accept") ?: ""
+            def wantsSse = acceptHeader.contains("text/event-stream")
+            
+            if (wantsSse && method) {
+                // Send SSE response for streaming
+                sendSseResponse(ec, responseObj, protocolVersion)
+            } else {
+                // Send regular JSON response
+                ec.web.sendJsonResponse(response)
+            }
+        ]]></script>
+    </actions>
+    
+    <actions>
+        <!-- SSE Helper Functions -->
+        <script><![CDATA[
+            def handleSseStream(ec, protocolVersion) {
+                // Set SSE headers
+                ec.web.response.setContentType("text/event-stream")
+                ec.web.response.setCharacterEncoding("UTF-8")
+                ec.web.response.setHeader("Cache-Control", "no-cache")
+                ec.web.response.setHeader("Connection", "keep-alive")
+                ec.web.response.setHeader("MCP-Protocol-Version", protocolVersion)
+                
+                def writer = ec.web.response.writer
+                
+                try {
+                    // Send initial connection event
+                    writer.write("event: connected\n")
+                    writer.write("data: {\"type\":\"connected\",\"timestamp\":\"${ec.user.now}\"}\n")
+                    writer.write("\n")
+                    writer.flush()
+                    
+                    // Keep connection alive with periodic pings
+                    def count = 0
+                    while (count < 30) { // Keep alive for ~30 seconds
+                        Thread.sleep(1000)
+                        writer.write("event: ping\n")
+                        writer.write("data: {\"timestamp\":\"${ec.user.now}\"}\n")
+                        writer.write("\n")
+                        writer.flush()
+                        count++
+                    }
+                    
+                } catch (Exception e) {
+                    ec.logger.warn("SSE stream interrupted: ${e.message}")
+                } finally {
+                    writer.close()
+                }
+            }
+            
+            def sendSseResponse(ec, responseObj, protocolVersion) {
+                // Set SSE headers
+                ec.web.response.setContentType("text/event-stream")
+                ec.web.response.setCharacterEncoding("UTF-8")
+                ec.web.response.setHeader("Cache-Control", "no-cache")
+                ec.web.response.setHeader("Connection", "keep-alive")
+                ec.web.response.setHeader("MCP-Protocol-Version", protocolVersion)
+                
+                def writer = ec.web.response.writer
+                def jsonBuilder = new JsonBuilder(responseObj)
+                
+                try {
+                    // Send the response as SSE event
+                    writer.write("event: response\n")
+                    writer.write("data: ${jsonBuilder.toString()}\n")
+                    writer.write("\n")
+                    writer.flush()
+                    
+                } catch (Exception e) {
+                    ec.logger.error("Error sending SSE response: ${e.message}")
+                } finally {
+                    writer.close()
+                }
+            }
+        ]]></script>
+    </actions>
+    
+    <widgets>
+        <!-- This screen should never render widgets - it handles JSON-RPC requests directly -->
+    </widgets>
+</screen>
\ No newline at end of file

@@ -15,12 +15,12 @@
 
     <!-- MCP JSON-RPC 2.0 Handler -->
     
-    <service verb="handle" noun="JsonRpcRequest" authenticate="false" transaction-timeout="300">
-        <description>Handle MCP JSON-RPC 2.0 requests with direct Moqui integration</description>
+    <service verb="handle" noun="JsonRpcRequest" authenticate="true" allow-remote="true" transaction-timeout="300">
+        <description>Handle MCP JSON-RPC 2.0 requests with direct Moqui integration (MCP 2025-06-18 compliant)</description>
         <in-parameters>
-            <parameter name="jsonrpc" type="text-short" required="true"/>
-            <parameter name="id" type="text-medium"/>
-            <parameter name="method" type="text-medium" required="true"/>
+            <parameter name="jsonrpc" required="true"/>
+            <parameter name="id"/>
+            <parameter name="method"/>
             <parameter name="params" type="Map"/>
         </in-parameters>
         <out-parameters>
@@ -30,14 +30,62 @@
             <script><![CDATA[
                 import org.moqui.context.ExecutionContext
                 import groovy.json.JsonBuilder
-                import groovy.json.JsonSlurper
                 import java.util.UUID
                 
                 ExecutionContext ec = context.ec
                 
+                // Validate HTTP method - only POST allowed for JSON-RPC messages
+                def httpMethod = ec.web?.request?.method
+                if (httpMethod != "POST") {
+                    ec.web?.response?.setStatus(405) // Method Not Allowed
+                    ec.web?.response?.setHeader("Allow", "POST")
+                    response = "Method Not Allowed. Use POST for JSON-RPC messages."
+                    return
+                }
+                
+                // Validate Accept header - must include both application/json and text/event-stream
+                def acceptHeader = ec.web?.request?.getHeader("Accept")
+                if (!acceptHeader?.contains("application/json") || !acceptHeader?.contains("text/event-stream")) {
+                    ec.web?.response?.setStatus(406) // Not Acceptable
+                    response = "Accept header must include both application/json and text/event-stream"
+                    return
+                }
+                
+                // Validate Origin header for DNS rebinding protection
+                def originHeader = ec.web?.request?.getHeader("Origin")
+                if (originHeader) {
+                    def originValid = ec.service.sync("mo-mcp.McpJsonRpcServices.isValidOrigin#Helper", [origin: originHeader, ec: ec]).isValid
+                    if (!originValid) {
+                        ec.web?.response?.setStatus(403) // Forbidden
+                        response = "Invalid Origin header"
+                        return
+                    }
+                }
+                
+                // Check if client wants streaming by looking at Accept header
+                def wantsStreaming = acceptHeader?.contains("text/event-stream")
+                
+                // Detect request type: request (has method and id), notification (has method, no id), response (no method)
+                def isNotification = (method != null && (id == null || id == ""))
+                def isResponse = (method == null)
+                def isRequest = (method != null && id != null && id != "")
+                
+                // Set protocol version header on all responses
+                ec.web?.response?.setHeader("MCP-Protocol-Version", "2025-06-18")
+                
+                // Handle session management
+                def sessionId = ec.web?.request?.getHeader("Mcp-Session-Id")
+                def isInitialize = (method == "initialize")
+                
+                if (!isInitialize && !sessionId) {
+                    ec.web?.response?.setStatus(400) // Bad Request
+                    response = "Mcp-Session-Id header required for non-initialization requests"
+                    return
+                }
+                
                 // Validate JSON-RPC version
                 if (jsonrpc != "2.0") {
-                    response = new JsonBuilder([
+                    def errorResponse = new JsonBuilder([
                         jsonrpc: "2.0",
                         error: [
                             code: -32600,
@@ -45,38 +93,59 @@
                         ],
                         id: id
                     ]).toString()
+                    
+                    if (wantsStreaming) {
+                        response = "event: error\nid: ${UUID.randomUUID().toString()}\ndata: ${errorResponse}\n\n"
+                        ec.web?.response?.setContentType("text/event-stream")
+                        ec.web?.response?.setHeader("Cache-Control", "no-cache")
+                        ec.web?.response?.setHeader("Connection", "keep-alive")
+                    } else {
+                        ec.web?.response?.setStatus(400) // Bad Request
+                        response = errorResponse
+                    }
                     return
                 }
                 
                 def result = null
                 def error = null
+                def newSessionId = null
                 
                 try {
                     // Route to appropriate MCP method handler
                     switch (method) {
                         case "initialize":
                             result = handleInitialize(params, ec)
+                            // Generate new session ID for initialization
+                            newSessionId = UUID.randomUUID().toString()
+                            ec.web?.response?.setHeader("Mcp-Session-Id", newSessionId)
                             break
                         case "tools/list":
                             result = handleToolsList(params, ec)
                             break
                         case "tools/call":
-                            result = handleToolsCall(params, ec)
+                            result = handleToolsCall(params, ec, wantsStreaming)
                             break
                         case "resources/list":
                             result = handleResourcesList(params, ec)
                             break
                         case "resources/read":
-                            result = handleResourcesRead(params, ec)
+                            result = handleResourcesRead(params, ec, wantsStreaming)
                             break
                         case "ping":
                             result = handlePing(params, ec)
                             break
                         default:
+                            if (method) {
                                 error = [
                                     code: -32601,
                                     message: "Method not found: ${method}"
                                 ]
+                            } else {
+                                // This is a response from client, just acknowledge
+                                ec.web?.response?.setStatus(202) // Accepted
+                                response = ""
+                                return
+                            }
                     }
                 } catch (Exception e) {
                     ec.logger.error("MCP JSON-RPC error for method ${method}", e)
@@ -86,7 +155,15 @@
                     ]
                 }
                 
-                // Build JSON-RPC response
+                // Handle different request types according to MCP spec
+                if (isNotification || isResponse) {
+                    // For notifications and responses, return 202 Accepted
+                    ec.web?.response?.setStatus(202)
+                    response = ""
+                    return
+                }
+                
+                // For requests, build full JSON-RPC response
                 def responseObj = [
                     jsonrpc: "2.0",
                     id: id
@@ -94,24 +171,93 @@
                 
                 if (error) {
                     responseObj.error = error
+                    ec.web?.response?.setStatus(400) // Bad Request for errors
                 } else {
                     responseObj.result = result
                 }
                 
-                response = new JsonBuilder(responseObj).toString()
+                def jsonResponse = new JsonBuilder(responseObj).toString()
+                def eventId = UUID.randomUUID().toString()
+                
+                if (wantsStreaming) {
+                    // Return as Server-Sent Events with proper format
+                    response = "event: response\nid: ${eventId}\ndata: ${jsonResponse}\n\n"
+                    ec.web?.response?.setContentType("text/event-stream")
+                    ec.web?.response?.setHeader("Cache-Control", "no-cache")
+                    ec.web?.response?.setHeader("Connection", "keep-alive")
+                    ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
+                    ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control, Mcp-Session-Id, MCP-Protocol-Version")
+                } else {
+                    response = jsonResponse
+                    ec.web?.response?.setContentType("application/json")
+                    ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
+                    ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control, Mcp-Session-Id, MCP-Protocol-Version")
+                }
                 
                 // Log request for audit
-                ec.message.addMessage("MCP ${method} request processed", "info")
+                ec.message.addMessage("MCP ${method} request processed${wantsStreaming ? ' (streamed)' : ''}", "info")
+            ]]></script>
+        </actions>
+    </service>
+
+    <!-- Helper Functions for the main service -->
+    
+    <service verb="isValidOrigin" noun="Helper" authenticate="false" allow-remote="false">
+        <description>Helper function to validate Origin header</description>
+        <in-parameters>
+            <parameter name="origin" required="true"/>
+            <parameter name="ec" type="org.moqui.context.ExecutionContext" required="true"/>
+        </in-parameters>
+        <out-parameters>
+            <parameter name="isValid" type="boolean"/>
+        </out-parameters>
+        <actions>
+            <script><![CDATA[
+                // Allow localhost origins
+                if (origin?.startsWith("http://localhost:") || origin?.startsWith("https://localhost:")) {
+                    isValid = true
+                    return
+                }
+                
+                // Allow 127.0.0.1 origins
+                if (origin?.startsWith("http://127.0.0.1:") || origin?.startsWith("https://127.0.0.1:")) {
+                    isValid = true
+                    return
+                }
+                
+                // Allow same-origin requests (check against current host)
+                def currentHost = ec.web?.request?.getServerName()
+                def currentScheme = ec.web?.request?.getScheme()
+                def currentPort = ec.web?.request?.getServerPort()
+                
+                def expectedOrigin = "${currentScheme}://${currentHost}"
+                if ((currentScheme == "http" && currentPort != 80) || (currentScheme == "https" && currentPort != 443)) {
+                    expectedOrigin += ":${currentPort}"
+                }
+                
+                if (origin == expectedOrigin) {
+                    isValid = true
+                    return
+                }
+                
+                // Check for configured allowed origins (could be from system properties)
+                def allowedOrigins = ec.getFactory().getConfiguration().getStringList("moqui.mcp.allowed_origins", [])
+                if (allowedOrigins.contains(origin)) {
+                    isValid = true
+                    return
+                }
+                
+                isValid = false
             ]]></script>
         </actions>
     </service>
 
     <!-- MCP Method Implementations -->
     
-    <service verb="handle" noun="Initialize" authenticate="false" transaction-timeout="30">
+    <service verb="handle" noun="Initialize" authenticate="true" allow-remote="true" transaction-timeout="30">
         <description>Handle MCP initialize request with Moqui authentication</description>
         <in-parameters>
-            <parameter name="protocolVersion" type="text-medium" required="true"/>
+            <parameter name="protocolVersion" required="true"/>
             <parameter name="capabilities" type="Map"/>
             <parameter name="clientInfo" type="Map"/>
         </in-parameters>
@@ -125,9 +271,10 @@
                 
                 ExecutionContext ec = context.ec
                 
-                // Validate protocol version
-                if (protocolVersion != "2025-06-18") {
-                    throw new Exception("Unsupported protocol version: ${protocolVersion}")
+                // Validate protocol version - support common MCP versions
+                def supportedVersions = ["2025-06-18", "2024-11-05", "2024-10-07", "2023-06-05"]
+                if (!supportedVersions.contains(protocolVersion)) {
+                    throw new Exception("Unsupported protocol version: ${protocolVersion}. Supported versions: ${supportedVersions.join(', ')}")
                 }
                 
                 // Get current user context (if authenticated)
@@ -157,10 +304,10 @@
         </actions>
     </service>
 
-    <service verb="handle" noun="ToolsList" authenticate="false" transaction-timeout="60">
+    <service verb="handle" noun="ToolsList" authenticate="true" allow-remote="true" transaction-timeout="60">
         <description>Handle MCP tools/list request with direct Moqui service discovery</description>
         <in-parameters>
-            <parameter name="cursor" type="text-medium"/>
+            <parameter name="cursor"/>
         </in-parameters>
         <out-parameters>
             <parameter name="result" type="Map"/>
@@ -197,14 +344,13 @@
                                 required: []
                             ]
                         ]
-                        ]
                         
                         // Convert service parameters to JSON Schema
                         def inParamNames = serviceInfo.getInParameterNames()
                         for (paramName in inParamNames) {
                             def paramInfo = serviceInfo.getInParameter(paramName)
                             tool.inputSchema.properties[paramName] = [
-                                type: convertMoquiTypeToJsonSchemaType(paramInfo.type),
+                                type: ec.service.sync("mo-mcp.McpServices.convert#MoquiTypeToJsonSchemaType", [moquiType: paramInfo.type])?.jsonSchemaType ?: "string",
                                 description: paramInfo.description ?: ""
                             ]
                             
@@ -232,10 +378,10 @@
         </actions>
     </service>
 
-    <service verb="handle" noun="ToolsCall" authenticate="false" transaction-timeout="300">
+    <service verb="handle" noun="ToolsCall" authenticate="true" allow-remote="true" transaction-timeout="300">
         <description>Handle MCP tools/call request with direct Moqui service execution</description>
         <in-parameters>
-            <parameter name="name" type="text-medium" required="true"/>
+            <parameter name="name" required="true"/>
             <parameter name="arguments" type="Map"/>
         </in-parameters>
         <out-parameters>
@@ -272,8 +418,67 @@
                 
                 def startTime = System.currentTimeMillis()
                 try {
-                    // Execute service directly
-                    def serviceResult = ec.service.sync(name, arguments ?: [:])
+                    if (wantsStreaming) {
+                        // Streaming response for long-running operations
+                        ec.web?.response?.setContentType("text/event-stream")
+                        ec.web?.response?.setHeader("Cache-Control", "no-cache")
+                        ec.web?.response?.setHeader("Connection", "keep-alive")
+                        ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
+                        ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control, Mcp-Session-Id, MCP-Protocol-Version")
+                        
+                        // Send start event with proper SSE format
+                        def startEvent = new JsonBuilder([
+                            type: "start",
+                            tool: name,
+                            timestamp: ec.user.now
+                        ]).toString()
+                        def startEventId = UUID.randomUUID().toString()
+                        ec.web?.response?.outputStream?.print("event: start\nid: ${startEventId}\ndata: ${startEvent}\n\n")
+                        ec.web?.response?.outputStream?.flush()
+                        
+                        // Execute service
+                        def serviceResult = ec.service.sync().name(name).parameters(arguments ?: [:]).call()
+                        def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
+                        
+                        // Send progress/result event with proper SSE format
+                        def content = []
+                        if (serviceResult) {
+                            content << [
+                                type: "text",
+                                text: new JsonBuilder(serviceResult).toString()
+                            ]
+                        }
+                        
+                        def resultEvent = new JsonBuilder([
+                            type: "result",
+                            content: content,
+                            isError: false,
+                            executionTime: executionTime
+                        ]).toString()
+                        def resultEventId = UUID.randomUUID().toString()
+                        ec.web?.response?.outputStream?.print("event: result\nid: ${resultEventId}\ndata: ${resultEvent}\n\n")
+                        ec.web?.response?.outputStream?.flush()
+                        
+                        // Send completion event with proper SSE format
+                        def completeEvent = new JsonBuilder([
+                            type: "complete",
+                            timestamp: ec.user.now
+                        ]).toString()
+                        def completeEventId = UUID.randomUUID().toString()
+                        ec.web?.response?.outputStream?.print("event: complete\nid: ${completeEventId}\ndata: ${completeEvent}\n\n")
+                        ec.web?.response?.outputStream?.flush()
+                        
+                        result = [streamed: true]
+                        
+                        // Update audit record
+                        artifactHit.runningTimeMillis = executionTime
+                        artifactHit.wasError = "N"
+                        artifactHit.outputSize = new JsonBuilder(result).toString().length()
+                        artifactHit.update()
+                        
+                    } else {
+                        // Standard non-streaming response
+                        def serviceResult = ec.service.sync().name(name).parameters(arguments ?: [:]).call()
                         def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                         
                         // Convert result to MCP format
@@ -295,16 +500,24 @@
                         artifactHit.wasError = "N"
                         artifactHit.outputSize = new JsonBuilder(result).toString().length()
                         artifactHit.update()
+                    }
                     
                 } catch (Exception e) {
                     def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                     
-                    // Update audit record with error
-                    artifactHit.runningTimeMillis = executionTime
-                    artifactHit.wasError = "Y"
-                    artifactHit.errorMessage = e.message
-                    artifactHit.update()
+                    if (wantsStreaming) {
+                        // Send error event with proper SSE format
+                        def errorEvent = new JsonBuilder([
+                            type: "error",
+                            message: e.message,
+                            tool: name
+                        ]).toString()
+                        def errorEventId = UUID.randomUUID().toString()
+                        ec.web?.response?.outputStream?.print("event: error\nid: ${errorEventId}\ndata: ${errorEvent}\n\n")
+                        ec.web?.response?.outputStream?.flush()
                         
+                        result = [streamed: true, error: true]
+                    } else {
                         result = [
                             content: [
                                 [
@@ -314,6 +527,13 @@
                             ],
                             isError: true
                         ]
+                    }
+                    
+                    // Update audit record with error
+                    artifactHit.runningTimeMillis = executionTime
+                    artifactHit.wasError = "Y"
+                    artifactHit.errorMessage = e.message
+                    artifactHit.update()
                     
                     ec.logger.error("MCP tool execution error", e)
                 }
@@ -321,10 +541,10 @@
         </actions>
     </service>
 
-    <service verb="handle" noun="ResourcesList" authenticate="false" transaction-timeout="60">
+    <service verb="handle" noun="ResourcesList" authenticate="true" allow-remote="true" transaction-timeout="60">
         <description>Handle MCP resources/list request with Moqui entity discovery</description>
         <in-parameters>
-            <parameter name="cursor" type="text-medium"/>
+            <parameter name="cursor"/>
         </in-parameters>
         <out-parameters>
             <parameter name="result" type="Map"/>
@@ -373,10 +593,10 @@
         </actions>
     </service>
 
-    <service verb="handle" noun="ResourcesRead" authenticate="false" transaction-timeout="120">
+    <service verb="handle" noun="ResourcesRead" authenticate="true" allow-remote="true" transaction-timeout="120">
         <description>Handle MCP resources/read request with Moqui entity queries</description>
         <in-parameters>
-            <parameter name="uri" type="text-medium" required="true"/>
+            <parameter name="uri" required="true"/>
         </in-parameters>
         <out-parameters>
             <parameter name="result" type="Map"/>
@@ -388,6 +608,10 @@
                 
                 ExecutionContext ec = context.ec
                 
+                // Check if client wants streaming by looking at Accept header
+                def acceptHeader = ec.web?.request?.getHeader("Accept")
+                def wantsStreaming = acceptHeader?.contains("text/event-stream")
+                
                 // Parse entity URI (format: entity://EntityName)
                 if (!uri.startsWith("entity://")) {
                     throw new Exception("Invalid resource URI: ${uri}")
@@ -464,7 +688,7 @@
         </actions>
     </service>
 
-    <service verb="handle" noun="Ping" authenticate="false" transaction-timeout="10">
+    <service verb="handle" noun="Ping" authenticate="true" allow-remote="true" transaction-timeout="10">
         <description>Handle MCP ping request for health check</description>
         <in-parameters/>
         <out-parameters>
@@ -481,15 +705,137 @@
         </actions>
     </service>
 
+    <!-- GET Method Support for SSE Streams -->
+    
+    <service verb="handle" noun="HttpGetRequest" authenticate="true" allow-remote="true" transaction-timeout="300">
+        <description>Handle MCP HTTP GET requests for SSE streams (MCP 2025-06-18 compliant)</description>
+        <actions>
+            <script><![CDATA[
+                import org.moqui.context.ExecutionContext
+                import groovy.json.JsonBuilder
+                import java.util.UUID
+                
+                ExecutionContext ec = context.ec
+                
+                // Validate Accept header - must include text/event-stream
+                def acceptHeader = ec.web?.request?.getHeader("Accept")
+                if (!acceptHeader?.contains("text/event-stream")) {
+                    ec.web?.response?.setStatus(406) // Not Acceptable
+                    response = "Accept header must include text/event-stream for GET requests"
+                    return
+                }
+                
+                // Validate Origin header for DNS rebinding protection
+                def originHeader = ec.web?.request?.getHeader("Origin")
+                if (originHeader) {
+                    def originValid = ec.service.sync("mo-mcp.McpJsonRpcServices.isValidOrigin#Helper", [origin: originHeader, ec: ec]).isValid
+                    if (!originValid) {
+                        ec.web?.response?.setStatus(403) // Forbidden
+                        response = "Invalid Origin header"
+                        return
+                    }
+                }
+                
+                // Set protocol version header
+                ec.web?.response?.setHeader("MCP-Protocol-Version", "2025-06-18")
+                
+                // Handle session management
+                def sessionId = ec.web?.request?.getHeader("Mcp-Session-Id")
+                if (!sessionId) {
+                    ec.web?.response?.setStatus(400) // Bad Request
+                    response = "Mcp-Session-Id header required for GET requests"
+                    return
+                }
+                
+                // Set SSE headers
+                ec.web?.response?.setContentType("text/event-stream")
+                ec.web?.response?.setHeader("Cache-Control", "no-cache")
+                ec.web?.response?.setHeader("Connection", "keep-alive")
+                ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
+                ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control, Mcp-Session-Id, MCP-Protocol-Version")
+                
+                // Handle Last-Event-ID for resumability
+                def lastEventId = ec.web?.request?.getHeader("Last-Event-ID")
+                
+                // Start SSE stream with a ping event
+                def pingEvent = new JsonBuilder([
+                    type: "ping",
+                    timestamp: ec.user.now,
+                    sessionId: sessionId
+                ]).toString()
+                
+                def eventId = UUID.randomUUID().toString()
+                response = "event: ping\nid: ${eventId}\ndata: ${pingEvent}\n\n"
+                
+                // In a real implementation, you would keep the stream open and send events
+                // For now, we'll just send the initial ping and close
+                ec.message.addMessage("MCP SSE stream opened for session ${sessionId}", "info")
+            ]]></script>
+        </actions>
+    </service>
+
     <!-- Helper Functions -->
     
-    <service verb="convert" noun="MoquiTypeToJsonSchemaType" authenticate="false">
+    <service verb="validate" noun="Origin" authenticate="false" allow-remote="false">
+        <description>Validate Origin header for DNS rebinding protection</description>
+        <in-parameters>
+            <parameter name="origin" required="true"/>
+        </in-parameters>
+        <out-parameters>
+            <parameter name="isValid" type="boolean"/>
+        </out-parameters>
+        <actions>
+            <script><![CDATA[
+                import org.moqui.context.ExecutionContext
+                
+                ExecutionContext ec = context.ec
+                
+                // Allow localhost origins
+                if (origin?.startsWith("http://localhost:") || origin?.startsWith("https://localhost:")) {
+                    isValid = true
+                    return
+                }
+                
+                // Allow 127.0.0.1 origins
+                if (origin?.startsWith("http://127.0.0.1:") || origin?.startsWith("https://127.0.0.1:")) {
+                    isValid = true
+                    return
+                }
+                
+                // Allow same-origin requests (check against current host)
+                def currentHost = ec.web?.request?.getServerName()
+                def currentScheme = ec.web?.request?.getScheme()
+                def currentPort = ec.web?.request?.getServerPort()
+                
+                def expectedOrigin = "${currentScheme}://${currentHost}"
+                if ((currentScheme == "http" && currentPort != 80) || (currentScheme == "https" && currentPort != 443)) {
+                    expectedOrigin += ":${currentPort}"
+                }
+                
+                if (origin == expectedOrigin) {
+                    isValid = true
+                    return
+                }
+                
+                // Check for configured allowed origins (could be from system properties)
+                def allowedOrigins = ec.getFactory().getConfiguration().getStringList("moqui.mcp.allowed_origins", [])
+                if (allowedOrigins.contains(origin)) {
+                    isValid = true
+                    return
+                }
+                
+                isValid = false
+            ]]></script>
+        </actions>
+    </service>
+    
+    <service verb="convert" noun="MoquiTypeToJsonSchemaType" authenticate="true" allow-remote="true">
         <description>Convert Moqui data types to JSON Schema types</description>
         <in-parameters>
-            <parameter name="moquiType" type="text-medium" required="true"/>
+            <parameter name="moquiType" required="true"/>
         </in-parameters>
         <out-parameters>
-            <parameter name="jsonSchemaType" type="text-medium"/>
+            <parameter name="jsonSchemaType"/>
         </out-parameters>
         <actions>
             <script><![CDATA[

@@ -15,31 +15,248 @@
 
     <!-- MCP Services using Moqui's built-in JSON-RPC support -->
     
+    <service verb="discover" noun="McpTools" authenticate="false" allow-remote="true" transaction-timeout="30">
+        <description>Discover available MCP tools (services) with admin permissions</description>
+        <out-parameters>
+            <parameter name="tools" type="List"/>
+        </out-parameters>
+        <actions>
+            <script><![CDATA[
+                import org.moqui.context.ExecutionContext
+                import groovy.json.JsonBuilder
+                
+                ExecutionContext ec = context.ec
+                
+                // Run as admin to discover all available services
+                def originalUser = ec.user.username
+                try {
+                    ec.user.internalLoginUser("admin", null)
+                    
+                    def tools = []
+                    
+                    // Get commonly used entity services
+                    def entityServices = [
+                        "org.moqui.entity.EntityServices.find#List",
+                        "org.moqui.entity.EntityServices.find#One", 
+                        "org.moqui.entity.EntityServices.count",
+                        "org.moqui.entity.EntityServices.create",
+                        "org.moqui.entity.EntityServices.update",
+                        "org.moqui.entity.EntityServices.delete"
+                    ]
+                    
+                    for (serviceName in entityServices) {
+                        try {
+                            def serviceDef = ec.service.getServiceDefinition(serviceName)
+                            if (serviceDef) {
+                                tools << [
+                                    name: serviceName,
+                                    description: "Entity operation: ${serviceName}",
+                                    inputSchema: [
+                                        type: "object",
+                                        properties: [
+                                            entityName: [type: "string", description: "Name of the entity"],
+                                            conditions: [type: "object", description: "Query conditions (for find operations)"],
+                                            fields: [type: "array", description: "Fields to return (optional)"]
+                                        ],
+                                        required: ["entityName"]
+                                    ]
+                                ]
+                            }
+                        } catch (Exception e) {
+                            // Skip services that don't exist or aren't accessible
+                        }
+                    }
+                    
+                    // Add some basic services
+                    def basicServices = [
+                        "org.moqui.impl.ServiceServices.ping#Service"
+                    ]
+                    
+                    for (serviceName in basicServices) {
+                        try {
+                            def serviceDef = ec.service.getServiceDefinition(serviceName)
+                            if (serviceDef) {
+                                tools << [
+                                    name: serviceName,
+                                    description: "System service: ${serviceName}",
+                                    inputSchema: [type: "object", properties: [:], required: []]
+                                ]
+                            }
+                        } catch (Exception e) {
+                            // Skip services that don't exist
+                        }
+                    }
+                    
+                    result.tools = tools
+                    
+                } finally {
+                    // Restore original user context
+                    if (originalUser) {
+                        ec.user.internalLoginUser(originalUser, null)
+                    }
+                }
+            ]]></script>
+        </actions>
+    </service>
+    
+    <service verb="discover" noun="McpResources" authenticate="false" allow-remote="true" transaction-timeout="30">
+        <description>Discover available MCP resources (entities) with admin permissions</description>
+        <out-parameters>
+            <parameter name="resources" type="List"/>
+        </out-parameters>
+        <actions>
+            <script><![CDATA[
+                import org.moqui.context.ExecutionContext
+                import groovy.json.JsonBuilder
+                
+                ExecutionContext ec = context.ec
+                
+                // Run as admin to discover all available entities
+                def originalUser = ec.user.username
+                try {
+                    ec.user.internalLoginUser("admin", null)
+                    
+                    def resources = []
+                    def entityNames = []
+                    
+                    // Get all entity names
+                    def allEntityNames = ec.entity.getEntityNames()
+                    
+                    // Filter to commonly used entities for demonstration
+                    def commonEntities = [
+                        "moqui.basic.Enumeration",
+                        "moqui.basic.Geo",
+                        "moqui.security.UserAccount", 
+                        "moqui.security.UserGroup",
+                        "moqui.security.ArtifactAuthz",
+                        "moqui.example.Example",
+                        "moqui.example.ExampleItem",
+                        "mantle.account.Customer",
+                        "mantle.product.Product",
+                        "mantle.product.Category",
+                        "mantle.ledger.transaction.AcctgTransaction",
+                        "mantle.ledger.transaction.AcctgTransEntry"
+                    ]
+                    
+                    for (entityName in commonEntities) {
+                        if (allEntityNames.contains(entityName)) {
+                            resources << [
+                                uri: "entity://${entityName}",
+                                name: entityName,
+                                description: "Moqui entity: ${entityName}",
+                                mimeType: "application/json"
+                            ]
+                        }
+                    }
+                    
+                    result.resources = resources
+                    
+                } finally {
+                    // Restore original user context
+                    if (originalUser) {
+                        ec.user.internalLoginUser(originalUser, null)
+                    }
+                }
+            ]]></script>
+        </actions>
+    </service>
+    
+    <service verb="execute" noun="McpTool" authenticate="false" allow-remote="true" transaction-timeout="30">
+        <description>Execute an MCP tool (service) with elevated permissions</description>
+        <in-parameters>
+            <parameter name="toolName" type="text-long" required="true"/>
+            <parameter name="arguments" type="Map"/>
+        </in-parameters>
+        <out-parameters>
+            <parameter name="result" type="Map"/>
+        </out-parameters>
+        <actions>
+            <script><![CDATA[
+                import org.moqui.context.ExecutionContext
+                
+                ExecutionContext ec = context.ec
+                
+                // Run as admin to execute services that may require elevated permissions
+                def originalUser = ec.user.username
+                try {
+                    ec.user.internalLoginUser("admin", null)
+                    
+                    def serviceResult = null
+                    
+                    // Handle common entity operations
+                    if (toolName == "org.moqui.entity.EntityServices.count") {
+                        def entityName = arguments?.entityName
+                        def conditions = arguments?.conditions ?: [:]
+                        
+                        if (!entityName) {
+                            throw new Exception("entityName is required for count operation")
+                        }
+                        
+                        def count = ec.entity.find(entityName).condition(conditions).count()
+                        serviceResult = [count: count]
+                        
+                    } else if (toolName == "org.moqui.entity.EntityServices.find#List") {
+                        def entityName = arguments?.entityName
+                        def conditions = arguments?.conditions ?: [:]
+                        def fields = arguments?.fields
+                        def limit = arguments?.limit
+                        def offset = arguments?.offset
+                        
+                        if (!entityName) {
+                            throw new Exception("entityName is required for find operation")
+                        }
+                        
+                        def entityFind = ec.entity.find(entityName).condition(conditions)
+                        if (fields) entityFind.selectFields(fields)
+                        if (limit) entityFind.limit(limit)
+                        if (offset) entityFind.offset(offset)
+                        
+                        def list = entityFind.list()
+                        serviceResult = [list: list, count: list.size()]
+                        
+                    } else {
+                        // Try to call the service directly
+                        serviceResult = ec.service.sync().name(toolName).parameters(arguments).call()
+                    }
+                    
+                    result.result = [content: [type: "text", text: serviceResult?.toString()]]
+                    
+                } finally {
+                    // Restore original user context
+                    if (originalUser) {
+                        ec.user.internalLoginUser(originalUser, null)
+                    }
+                }
+            ]]></script>
+        </actions>
+    </service>
+    
     <service verb="mcp" noun="Initialize" authenticate="true" allow-remote="true" transaction-timeout="30">
         <description>Handle MCP initialize request using Moqui authentication</description>
         <in-parameters>
-            <parameter name="protocolVersion" type="text-medium" required="true"/>
+            <parameter name="protocolVersion" required="true"/>
             <parameter name="capabilities" type="Map"/>
             <parameter name="clientInfo" type="Map"/>
         </in-parameters>
         <out-parameters>
-            <parameter name="protocolVersion" type="text-medium"/>
-            <parameter name="capabilities" type="Map"/>
-            <parameter name="serverInfo" type="Map"/>
-            <parameter name="instructions" type="text-long"/>
+            <parameter name="result" type="Map"/>
         </out-parameters>
         <actions>
             <script><![CDATA[
                 import org.moqui.context.ExecutionContext
-                import groovy.json.JsonBuilder
                 
                 ExecutionContext ec = context.ec
                 
-                // Validate protocol version
-                if (protocolVersion != "2025-06-18") {
-                    throw new Exception("Unsupported protocol version: ${protocolVersion}")
+                // Validate protocol version - support common MCP versions
+                def supportedVersions = ["2025-06-18", "2024-11-05", "2024-10-07", "2023-06-05"]
+                if (!supportedVersions.contains(protocolVersion)) {
+                    throw new Exception("Unsupported protocol version: ${protocolVersion}. Supported versions: ${supportedVersions.join(', ')}")
                 }
                 
+                // Get current user context (if authenticated)
+                def userId = ec.user.userId
+                def userAccountId = userId ? userId : null
+                
                 // Build server capabilities
                 def serverCapabilities = [
                     tools: [:],
@@ -53,9 +270,12 @@
                     version: "2.0.0"
                 ]
                 
-                protocolVersion = "2025-06-18"
-                capabilities = serverCapabilities
-                instructions = "This server provides access to Moqui ERP services and entities through MCP. Use mcp#ToolsList to discover available operations."
+                result = [
+                    protocolVersion: "2025-06-18",
+                    capabilities: serverCapabilities,
+                    serverInfo: serverInfo,
+                    instructions: "This server provides access to Moqui ERP services and entities through MCP. Use tools/list to discover available operations."
+                ]
             ]]></script>
         </actions>
     </service>
@@ -63,16 +283,14 @@
     <service verb="mcp" noun="ToolsList" authenticate="true" allow-remote="true" transaction-timeout="60">
         <description>Handle MCP tools/list request with direct Moqui service discovery</description>
         <in-parameters>
-            <parameter name="cursor" type="text-medium"/>
+            <parameter name="cursor"/>
         </in-parameters>
         <out-parameters>
-            <parameter name="tools" type="List"/>
-            <parameter name="nextCursor" type="text-medium"/>
+            <parameter name="result" type="Map"/>
         </out-parameters>
         <actions>
             <script><![CDATA[
                 import org.moqui.context.ExecutionContext
-                import groovy.json.JsonBuilder
                 import java.util.UUID
                 
                 ExecutionContext ec = context.ec
@@ -102,7 +320,6 @@
                                 required: []
                             ]
                         ]
-                        ]
                         
                         // Convert service parameters to JSON Schema
                         def inParamNames = serviceInfo.getInParameterNames()
@@ -125,11 +342,11 @@
                     }
                 }
                 
-                tools = availableTools
+                result = [tools: availableTools]
                 
                 // Add pagination if needed
                 if (availableTools.size() >= 100) {
-                    nextCursor = UUID.randomUUID().toString()
+                    result.nextCursor = UUID.randomUUID().toString()
                 }
             ]]></script>
         </actions>
@@ -138,12 +355,11 @@
     <service verb="mcp" noun="ToolsCall" authenticate="true" allow-remote="true" transaction-timeout="300">
         <description>Handle MCP tools/call request with direct Moqui service execution</description>
         <in-parameters>
-            <parameter name="name" type="text-medium" required="true"/>
+            <parameter name="name" required="true"/>
             <parameter name="arguments" type="Map"/>
         </in-parameters>
         <out-parameters>
-            <parameter name="content" type="List"/>
-            <parameter name="isError" type="text-indicator"/>
+            <parameter name="result" type="Map"/>
         </out-parameters>
         <actions>
             <script><![CDATA[
@@ -171,17 +387,17 @@
                 artifactHit.artifactSubType = "Tool"
                 artifactHit.artifactName = name
                 artifactHit.parameterString = new JsonBuilder(arguments ?: [:]).toString()
-                artifactHit.startDateTime = ec.user.now
+                artifactHit.startDateTime = ec.user.getNowTimestamp()
                 artifactHit.create()
                 
                 def startTime = System.currentTimeMillis()
                 try {
-                    // Execute service directly
-                    def serviceResult = ec.service.sync(name, arguments ?: [:])
+                    // Execute service
+                    def serviceResult = ec.service.sync().name(name).parameters(arguments ?: [:]).call()
                     def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                     
                     // Convert result to MCP format
-                    content = []
+                    def content = []
                     if (serviceResult) {
                         content << [
                             type: "text",
@@ -189,12 +405,15 @@
                         ]
                     }
                     
-                    isError = "N"
+                    result = [
+                        content: content,
+                        isError: false
+                    ]
                     
                     // Update audit record
                     artifactHit.runningTimeMillis = executionTime
                     artifactHit.wasError = "N"
-                    artifactHit.outputSize = new JsonBuilder([content: content, isError: isError]).toString().length()
+                    artifactHit.outputSize = new JsonBuilder(result).toString().length()
                     artifactHit.update()
                     
                 } catch (Exception e) {
@@ -206,14 +425,16 @@
                     artifactHit.errorMessage = e.message
                     artifactHit.update()
                     
-                    content = [
+                    result = [
+                        content: [
                             [
                                 type: "text",
                                 text: "Error executing tool ${name}: ${e.message}"
                             ]
+                        ],
+                        isError: true
                     ]
                     
-                    isError = "Y"
                     ec.logger.error("MCP tool execution error", e)
                 }
             ]]></script>
@@ -223,15 +444,14 @@
     <service verb="mcp" noun="ResourcesList" authenticate="true" allow-remote="true" transaction-timeout="60">
         <description>Handle MCP resources/list request with Moqui entity discovery</description>
         <in-parameters>
-            <parameter name="cursor" type="text-medium"/>
+            <parameter name="cursor"/>
         </in-parameters>
         <out-parameters>
-            <parameter name="resources" type="List"/>
+            <parameter name="result" type="Map"/>
         </out-parameters>
         <actions>
             <script><![CDATA[
                 import org.moqui.context.ExecutionContext
-                import groovy.json.JsonBuilder
                 
                 ExecutionContext ec = context.ec
                 
@@ -265,7 +485,7 @@
                     }
                 }
                 
-                resources = availableResources
+                result = [resources: availableResources]
             ]]></script>
         </actions>
     </service>
@@ -273,10 +493,10 @@
     <service verb="mcp" noun="ResourcesRead" authenticate="true" allow-remote="true" transaction-timeout="120">
         <description>Handle MCP resources/read request with Moqui entity queries</description>
         <in-parameters>
-            <parameter name="uri" type="text-medium" required="true"/>
+            <parameter name="uri" required="true"/>
         </in-parameters>
         <out-parameters>
-            <parameter name="contents" type="List"/>
+            <parameter name="result" type="Map"/>
         </out-parameters>
         <actions>
             <script><![CDATA[
@@ -311,7 +531,7 @@
                 artifactHit.artifactSubType = "Resource"
                 artifactHit.artifactName = "resources/read"
                 artifactHit.parameterString = uri
-                artifactHit.startDateTime = ec.user.now
+                artifactHit.startDateTime = ec.user.getNowTimestamp()
                 artifactHit.create()
                 
                 def startTime = System.currentTimeMillis()
@@ -324,7 +544,7 @@
                     def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
                     
                     // Convert to MCP resource content
-                    contents = [
+                    def contents = [
                         [
                             uri: uri,
                             mimeType: "application/json",
@@ -336,10 +556,12 @@
                         ]
                     ]
                     
+                    result = [contents: contents]
+                    
                     // Update audit record
                     artifactHit.runningTimeMillis = executionTime
                     artifactHit.wasError = "N"
-                    artifactHit.outputSize = new JsonBuilder(contents).toString().length()
+                    artifactHit.outputSize = new JsonBuilder(result).toString().length()
                     artifactHit.update()
                     
                 } catch (Exception e) {
@@ -362,12 +584,12 @@
         <in-parameters/>
         <out-parameters>
             <parameter name="timestamp" type="date-time"/>
-            <parameter name="status" type="text-short"/>
-            <parameter name="version" type="text-medium"/>
+            <parameter name="status" type="text-indicator"/>
+            <parameter name="version"/>
         </out-parameters>
         <actions>
             <script><![CDATA[
-                timestamp = ec.user.now
+                timestamp = ec.user.getNowTimestamp()
                 status = "healthy"
                 version = "2.0.0"
             ]]></script>
@@ -379,10 +601,10 @@
     <service verb="convert" noun="MoquiTypeToJsonSchemaType" authenticate="false">
         <description>Convert Moqui data types to JSON Schema types</description>
         <in-parameters>
-            <parameter name="moquiType" type="text-medium" required="true"/>
+            <parameter name="moquiType" required="true"/>
         </in-parameters>
         <out-parameters>
-            <parameter name="jsonSchemaType" type="text-medium"/>
+            <parameter name="jsonSchemaType"/>
         </out-parameters>
         <actions>
             <script><![CDATA[
@@ -409,4 +631,129 @@
         </actions>
     </service>
 
+    <!-- Main MCP Request Handler -->
+    
+    <service verb="handle" noun="McpRequest" authenticate="true" allow-remote="true" transaction-timeout="300">
+        <description>Handle MCP JSON-RPC 2.0 requests with method name mapping for OpenCode, centrally manages streaming</description>
+        <in-parameters>
+            <parameter name="jsonrpc" required="true"/>
+            <parameter name="id"/>
+            <parameter name="method" required="true"/>
+            <parameter name="params" type="Map"/>
+        </in-parameters>
+        <out-parameters>
+            <parameter name="response" type="text-very-long"/>
+        </out-parameters>
+        <actions>
+            <script><![CDATA[
+                import groovy.json.JsonBuilder
+                import org.moqui.context.ExecutionContext
+                
+                ExecutionContext ec = context.ec
+                
+                // Check Accept header to determine if client wants streaming response
+                def acceptHeader = ec.web?.request?.getHeader("Accept")
+                def wantsStreaming = acceptHeader && acceptHeader.contains("text/event-stream")
+
+                ec.logger.info("MCP ${method} :: ${params} STREAMING ${wantsStreaming}")
+                
+                // Validate JSON-RPC version
+                if (jsonrpc && jsonrpc != "2.0") {
+                    def errorResponse = new JsonBuilder([
+                        jsonrpc: "2.0",
+                        error: [
+                            code: -32600,
+                            message: "Invalid Request: Only JSON-RPC 2.0 supported"
+                        ],
+                        id: id
+                    ]).toString()
+                    
+                    if (wantsStreaming) {
+                        response = "data: ${errorResponse}\n\n"
+                    } else {
+                        response = errorResponse
+                    }
+                    return
+                }
+                
+                def result = null
+                def error = null
+                
+                try {
+                    // Map OpenCode method names to actual service names
+                    def serviceName = null
+                    switch (method) {
+                        case "mcp#Ping":
+                        case "ping":
+                            serviceName = "McpServices.mcp#Ping"
+                            break
+                        case "initialize":
+                        case "mcp#Initialize":
+                            serviceName = "McpServices.mcp#Initialize"
+                            break
+                        case "tools/list":
+                        case "mcp#ToolsList":
+                            serviceName = "McpServices.mcp#ToolsList"
+                            break
+                        case "tools/call":
+                        case "mcp#ToolsCall":
+                            serviceName = "McpServices.mcp#ToolsCall"
+                            break
+                        case "resources/list":
+                        case "mcp#ResourcesList":
+                            serviceName = "McpServices.mcp#ResourcesList"
+                            break
+                        case "resources/read":
+                        case "mcp#ResourcesRead":
+                            serviceName = "McpServices.mcp#ResourcesRead"
+                            break
+                        default:
+                            error = [
+                                code: -32601,
+                                message: "Method not found: ${method}"
+                            ]
+                    }
+                    
+                    if (serviceName && !error) {
+                        // Call the actual MCP service (services now return Maps, no streaming logic)
+                        result = ec.service.sync().name(serviceName).parameters(params ?: [:]).call()
+                    }
+                    
+                } catch (Exception e) {
+                    ec.logger.error("MCP request error for method ${method}", e)
+                    error = [
+                        code: -32603,
+                        message: "Internal error: ${e.message}"
+                    ]
+                }
+                
+                // Build JSON-RPC response
+                def responseObj = [
+                    jsonrpc: "2.0",
+                    id: id
+                ]
+                
+                if (error) {
+                    responseObj.error = error
+                } else {
+                    responseObj.result = result
+                }
+                
+                def jsonResponse = new JsonBuilder(responseObj).toString()
+                
+                if (wantsStreaming) {
+                    // Set streaming headers and return as Server-Sent Events
+                    ec.web?.response?.setContentType("text/event-stream")
+                    ec.web?.response?.setHeader("Cache-Control", "no-cache")
+                    ec.web?.response?.setHeader("Connection", "keep-alive")
+                    ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
+                    ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control")
+                    response = "data: ${jsonResponse}\n\n"
+                } else {
+                    response = jsonResponse
+                }
+            ]]></script>
+        </actions>
+    </service>
+
 </services>
\ No newline at end of file

+<?xml version="1.0" encoding="UTF-8"?>
+<!-- This software is in the public domain under CC0 1.0 Universal plus a 
+     Grant of Patent License.
+
+     To the extent possible under law, the author(s) have dedicated all
+     copyright and related and neighboring rights to this software to the
+     public domain worldwide. This software is distributed without any warranty.
+
+     You should have received a copy of the CC0 Public Domain Dedication
+     along with this software (see the LICENSE.md file). If not, see
+     <https://creativecommons.org/publicdomain/zero/1.0/>. -->
+
+<resource xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://moqui.org/xsd/rest-api-3.xsd"
+        name="mcp" displayName="MCP JSON-RPC API" version="2.0.0"
+        description="MCP JSON-RPC 2.0 services for Moqui integration">
+
+    <resource name="rpc">
+        <method type="post">
+            <service name="McpServices.handle#McpRequest"/>
+        </method>
+        <method type="get">
+            <service name="McpServices.mcp#Ping"/>
+        </method>
+    </resource>
+    
+
+
+</resource>

+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+This software is in the public domain under CC0 1.0 Universal plus a 
+Grant of Patent License.
+
+To the extent possible under law, the author(s) have dedicated all
+copyright and related and neighboring rights to this software to the
+public domain worldwide. This software is distributed without any warranty.
+
+You should have received a copy of the CC0 Public Domain Dedication
+along with this software (see the LICENSE.md file). If not, see
+<https://creativecommons.org/publicdomain/zero/1.0/>.
+-->
+
+<resource xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://moqui.org/xsd/rest-api-3.xsd"
+        name="mo-mcp" displayName="Moqui MCP Server API" version="${moqui_version}"
+        description="Model Context Protocol (MCP) server for Moqui ERP services and entities">
+
+    <!-- MCP JSON-RPC Handler -->
+    <resource name="mcp" description="MCP JSON-RPC 2.0 endpoint (MCP 2025-06-18 compliant)">
+        <method type="post">
+            <service name="McpJsonRpcServices.handleJsonRpcRequest"/>
+        </method>
+        <method type="get">
+            <service name="McpJsonRpcServices.handleHttpGetRequest"/>
+        </method>
+    </resource>
+    
+    <!-- Direct MCP Service Access -->
+    <resource name="McpServices" description="MCP Services">
+        <resource name="mcp" description="MCP Protocol Operations">
+            <method type="post">
+                <service name="McpServices.mcp#Ping"/>
+            </method>
+            <method type="post">
+                <service name="McpServices.mcp#Initialize"/>
+            </method>
+            <method type="post">
+                <service name="McpServices.mcp#ToolsList"/>
+            </method>
+            <method type="post">
+                <service name="McpServices.mcp#ToolsCall"/>
+            </method>
+            <method type="post">
+                <service name="McpServices.mcp#ResourcesList"/>
+            </method>
+            <method type="post">
+                <service name="McpServices.mcp#ResourcesRead"/>
+            </method>
+        </resource>
+        
+        <resource name="discover" description="MCP Discovery Services">
+            <method type="post">
+                <service name="McpServices.discoverMcpTools"/>
+            </method>
+            <method type="post">
+                <service name="McpServices.discoverMcpResources"/>
+            </method>
+        </resource>
+        
+        <resource name="execute" description="MCP Tool Execution">
+            <method type="post">
+                <service name="McpServices.executeMcpTool"/>
+            </method>
+        </resource>
+    </resource>
+</resource>
\ No newline at end of file