Skip to content

Ean Schuessler / mo-mcp

Go to a project
Toggle navigation
Toggle navigation pinning
d55e1a70 by Ean Schuessler
Options

MVP: Simplify MCP to JSON-RPC 2.0 only 

- Remove SSE streaming support for MVP simplicity
- Force JSON-RPC 2.0 responses regardless of Accept header
- Simplify REST configuration to only support application/json
- Clean up duplicate Accept header validation
- Remove streaming response logic and headers

This enables opencode connection without SSE complexity
while preserving full MCP protocol functionality.
1 parent c3b2172d
Inline Side-by-side
Showing 3 changed files with 282 additions and 892 deletions
<?xml version="1.0" encoding="UTF-8"?>
<!-- This software is in the public domain under CC0 1.0 Universal plus a
Grant of Patent License.
To the extent possible under law, the author(s) have dedicated all
copyright and related and neighboring rights to this software to the
public domain worldwide. This software is distributed without any warranty.
You should have received a copy of the CC0 Public Domain Dedication
along with this software (see the LICENSE.md file). If not, see
<https://creativecommons.org/publicdomain/zero/1.0/>. -->
<services xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://moqui.org/xsd/service-definition-3.xsd">
<!-- MCP JSON-RPC 2.0 Handler -->
<service verb="handle" noun="JsonRpcRequest" authenticate="true" allow-remote="true" transaction-timeout="300">
<description>Handle MCP JSON-RPC 2.0 requests with direct Moqui integration (MCP 2025-06-18 compliant)</description>
<in-parameters>
<parameter name="jsonrpc" required="true"/>
<parameter name="id"/>
<parameter name="method"/>
<parameter name="params" type="Map"/>
</in-parameters>
<out-parameters>
<parameter name="response" type="text-very-long"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
import groovy.json.JsonBuilder
import java.util.UUID
ExecutionContext ec = context.ec
// Validate HTTP method - only POST allowed for JSON-RPC messages
def httpMethod = ec.web?.request?.method
if (httpMethod != "POST") {
ec.web?.response?.setStatus(405) // Method Not Allowed
ec.web?.response?.setHeader("Allow", "POST")
response = "Method Not Allowed. Use POST for JSON-RPC messages."
return
}
// Validate Accept header - must include both application/json and text/event-stream
def acceptHeader = ec.web?.request?.getHeader("Accept")
if (!acceptHeader?.contains("application/json") || !acceptHeader?.contains("text/event-stream")) {
ec.web?.response?.setStatus(406) // Not Acceptable
response = "Accept header must include both application/json and text/event-stream"
return
}
// Validate Origin header for DNS rebinding protection
def originHeader = ec.web?.request?.getHeader("Origin")
if (originHeader) {
def originValid = ec.service.sync("mo-mcp.McpJsonRpcServices.isValidOrigin#Helper", [origin: originHeader, ec: ec]).isValid
if (!originValid) {
ec.web?.response?.setStatus(403) // Forbidden
response = "Invalid Origin header"
return
}
}
// Check if client wants streaming by looking at Accept header
def wantsStreaming = acceptHeader?.contains("text/event-stream")
// Detect request type: request (has method and id), notification (has method, no id), response (no method)
def isNotification = (method != null && (id == null || id == ""))
def isResponse = (method == null)
def isRequest = (method != null && id != null && id != "")
// Set protocol version header on all responses
ec.web?.response?.setHeader("MCP-Protocol-Version", "2025-06-18")
// Handle session management
def sessionId = ec.web?.request?.getHeader("Mcp-Session-Id")
def isInitialize = (method == "initialize")
if (!isInitialize && !sessionId) {
ec.web?.response?.setStatus(400) // Bad Request
response = "Mcp-Session-Id header required for non-initialization requests"
return
}
// Validate JSON-RPC version
if (jsonrpc != "2.0") {
def errorResponse = new JsonBuilder([
jsonrpc: "2.0",
error: [
code: -32600,
message: "Invalid Request: Only JSON-RPC 2.0 supported"
],
id: id
]).toString()
if (wantsStreaming) {
response = "event: error\nid: ${UUID.randomUUID().toString()}\ndata: ${errorResponse}\n\n"
ec.web?.response?.setContentType("text/event-stream")
ec.web?.response?.setHeader("Cache-Control", "no-cache")
ec.web?.response?.setHeader("Connection", "keep-alive")
} else {
ec.web?.response?.setStatus(400) // Bad Request
response = errorResponse
}
return
}
def result = null
def error = null
def newSessionId = null
try {
// Route to appropriate MCP method handler
switch (method) {
case "initialize":
result = handleInitialize(params, ec)
// Generate new session ID for initialization
newSessionId = UUID.randomUUID().toString()
ec.web?.response?.setHeader("Mcp-Session-Id", newSessionId)
break
case "tools/list":
result = handleToolsList(params, ec)
break
case "tools/call":
result = handleToolsCall(params, ec, wantsStreaming)
break
case "resources/list":
result = handleResourcesList(params, ec)
break
case "resources/read":
result = handleResourcesRead(params, ec, wantsStreaming)
break
case "ping":
result = handlePing(params, ec)
break
default:
if (method) {
error = [
code: -32601,
message: "Method not found: ${method}"
]
} else {
// This is a response from client, just acknowledge
ec.web?.response?.setStatus(202) // Accepted
response = ""
return
}
}
} catch (Exception e) {
ec.logger.error("MCP JSON-RPC error for method ${method}", e)
error = [
code: -32603,
message: "Internal error: ${e.message}"
]
}
// Handle different request types according to MCP spec
if (isNotification || isResponse) {
// For notifications and responses, return 202 Accepted
ec.web?.response?.setStatus(202)
response = ""
return
}
// For requests, build full JSON-RPC response
def responseObj = [
jsonrpc: "2.0",
id: id
]
if (error) {
responseObj.error = error
ec.web?.response?.setStatus(400) // Bad Request for errors
} else {
responseObj.result = result
}
def jsonResponse = new JsonBuilder(responseObj).toString()
def eventId = UUID.randomUUID().toString()
if (wantsStreaming) {
// Return as Server-Sent Events with proper format
response = "event: response\nid: ${eventId}\ndata: ${jsonResponse}\n\n"
ec.web?.response?.setContentType("text/event-stream")
ec.web?.response?.setHeader("Cache-Control", "no-cache")
ec.web?.response?.setHeader("Connection", "keep-alive")
ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control, Mcp-Session-Id, MCP-Protocol-Version")
} else {
response = jsonResponse
ec.web?.response?.setContentType("application/json")
ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control, Mcp-Session-Id, MCP-Protocol-Version")
}
// Log request for audit
ec.message.addMessage("MCP ${method} request processed${wantsStreaming ? ' (streamed)' : ''}", "info")
]]></script>
</actions>
</service>
<!-- Helper Functions for the main service -->
<service verb="isValidOrigin" noun="Helper" authenticate="false" allow-remote="false">
<description>Helper function to validate Origin header</description>
<in-parameters>
<parameter name="origin" required="true"/>
<parameter name="ec" type="org.moqui.context.ExecutionContext" required="true"/>
</in-parameters>
<out-parameters>
<parameter name="isValid" type="boolean"/>
</out-parameters>
<actions>
<script><![CDATA[
// Allow localhost origins
if (origin?.startsWith("http://localhost:") || origin?.startsWith("https://localhost:")) {
isValid = true
return
}
// Allow 127.0.0.1 origins
if (origin?.startsWith("http://127.0.0.1:") || origin?.startsWith("https://127.0.0.1:")) {
isValid = true
return
}
// Allow same-origin requests (check against current host)
def currentHost = ec.web?.request?.getServerName()
def currentScheme = ec.web?.request?.getScheme()
def currentPort = ec.web?.request?.getServerPort()
def expectedOrigin = "${currentScheme}://${currentHost}"
if ((currentScheme == "http" && currentPort != 80) || (currentScheme == "https" && currentPort != 443)) {
expectedOrigin += ":${currentPort}"
}
if (origin == expectedOrigin) {
isValid = true
return
}
// Check for configured allowed origins (could be from system properties)
def allowedOrigins = ec.getFactory().getConfiguration().getStringList("moqui.mcp.allowed_origins", [])
if (allowedOrigins.contains(origin)) {
isValid = true
return
}
isValid = false
]]></script>
</actions>
</service>
<!-- MCP Method Implementations -->
<service verb="handle" noun="Initialize" authenticate="true" allow-remote="true" transaction-timeout="30">
<description>Handle MCP initialize request with Moqui authentication</description>
<in-parameters>
<parameter name="protocolVersion" required="true"/>
<parameter name="capabilities" type="Map"/>
<parameter name="clientInfo" type="Map"/>
</in-parameters>
<out-parameters>
<parameter name="result" type="Map"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
import groovy.json.JsonBuilder
ExecutionContext ec = context.ec
// Validate protocol version - support common MCP versions
def supportedVersions = ["2025-06-18", "2024-11-05", "2024-10-07", "2023-06-05"]
if (!supportedVersions.contains(protocolVersion)) {
throw new Exception("Unsupported protocol version: ${protocolVersion}. Supported versions: ${supportedVersions.join(', ')}")
}
// Get current user context (if authenticated)
def userId = ec.user.userId
def userAccountId = userId ? userId : null
// Build server capabilities
def serverCapabilities = [
tools: [:],
resources: [:],
logging: [:]
]
// Build server info
def serverInfo = [
name: "Moqui MCP Server",
version: "2.0.0"
]
result = [
protocolVersion: "2025-06-18",
capabilities: serverCapabilities,
serverInfo: serverInfo,
instructions: "This server provides access to Moqui ERP services and entities through MCP. Use tools/list to discover available operations."
]
]]></script>
</actions>
</service>
<service verb="handle" noun="ToolsList" authenticate="true" allow-remote="true" transaction-timeout="60">
<description>Handle MCP tools/list request with direct Moqui service discovery</description>
<in-parameters>
<parameter name="cursor"/>
</in-parameters>
<out-parameters>
<parameter name="result" type="Map"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
import groovy.json.JsonBuilder
ExecutionContext ec = context.ec
// Get all service names from Moqui service engine
def allServiceNames = ec.service.getServiceNames()
def availableTools = []
// Convert services to MCP tools
for (serviceName in allServiceNames) {
try {
// Check if user has permission
if (!ec.service.hasPermission(serviceName)) {
continue
}
def serviceInfo = ec.service.getServiceInfo(serviceName)
if (!serviceInfo) continue
// Convert service to MCP tool format
def tool = [
name: serviceName,
description: serviceInfo.description ?: "Moqui service: ${serviceName}",
inputSchema: [
type: "object",
properties: [:],
required: []
]
]
// Convert service parameters to JSON Schema
def inParamNames = serviceInfo.getInParameterNames()
for (paramName in inParamNames) {
def paramInfo = serviceInfo.getInParameter(paramName)
tool.inputSchema.properties[paramName] = [
type: ec.service.sync("mo-mcp.McpServices.convert#MoquiTypeToJsonSchemaType", [moquiType: paramInfo.type])?.jsonSchemaType ?: "string",
description: paramInfo.description ?: ""
]
if (paramInfo.required) {
tool.inputSchema.required << paramName
}
}
availableTools << tool
} catch (Exception e) {
ec.logger.warn("Error processing service ${serviceName}: ${e.message}")
}
}
result = [
tools: availableTools
]
// Add pagination if needed
if (availableTools.size() >= 100) {
result.nextCursor = UUID.randomUUID().toString()
}
]]></script>
</actions>
</service>
<service verb="handle" noun="ToolsCall" authenticate="true" allow-remote="true" transaction-timeout="300">
<description>Handle MCP tools/call request with direct Moqui service execution</description>
<in-parameters>
<parameter name="name" required="true"/>
<parameter name="arguments" type="Map"/>
</in-parameters>
<out-parameters>
<parameter name="result" type="Map"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
import groovy.json.JsonBuilder
ExecutionContext ec = context.ec
// Validate service exists
if (!ec.service.isServiceDefined(name)) {
throw new Exception("Tool not found: ${name}")
}
// Check permission
if (!ec.service.hasPermission(name)) {
throw new Exception("Permission denied for tool: ${name}")
}
// Create audit record
def artifactHit = ec.entity.makeValue("moqui.server.ArtifactHit")
artifactHit.setSequencedIdPrimary()
artifactHit.visitId = ec.web?.visitId
artifactHit.userId = ec.user.userId
artifactHit.artifactType = "MCP"
artifactHit.artifactSubType = "Tool"
artifactHit.artifactName = name
artifactHit.parameterString = new JsonBuilder(arguments ?: [:]).toString()
artifactHit.startDateTime = ec.user.now
artifactHit.create()
def startTime = System.currentTimeMillis()
try {
if (wantsStreaming) {
// Streaming response for long-running operations
ec.web?.response?.setContentType("text/event-stream")
ec.web?.response?.setHeader("Cache-Control", "no-cache")
ec.web?.response?.setHeader("Connection", "keep-alive")
ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control, Mcp-Session-Id, MCP-Protocol-Version")
// Send start event with proper SSE format
def startEvent = new JsonBuilder([
type: "start",
tool: name,
timestamp: ec.user.now
]).toString()
def startEventId = UUID.randomUUID().toString()
ec.web?.response?.outputStream?.print("event: start\nid: ${startEventId}\ndata: ${startEvent}\n\n")
ec.web?.response?.outputStream?.flush()
// Execute service
def serviceResult = ec.service.sync().name(name).parameters(arguments ?: [:]).call()
def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
// Send progress/result event with proper SSE format
def content = []
if (serviceResult) {
content << [
type: "text",
text: new JsonBuilder(serviceResult).toString()
]
}
def resultEvent = new JsonBuilder([
type: "result",
content: content,
isError: false,
executionTime: executionTime
]).toString()
def resultEventId = UUID.randomUUID().toString()
ec.web?.response?.outputStream?.print("event: result\nid: ${resultEventId}\ndata: ${resultEvent}\n\n")
ec.web?.response?.outputStream?.flush()
// Send completion event with proper SSE format
def completeEvent = new JsonBuilder([
type: "complete",
timestamp: ec.user.now
]).toString()
def completeEventId = UUID.randomUUID().toString()
ec.web?.response?.outputStream?.print("event: complete\nid: ${completeEventId}\ndata: ${completeEvent}\n\n")
ec.web?.response?.outputStream?.flush()
result = [streamed: true]
// Update audit record
artifactHit.runningTimeMillis = executionTime
artifactHit.wasError = "N"
artifactHit.outputSize = new JsonBuilder(result).toString().length()
artifactHit.update()
} else {
// Standard non-streaming response
def serviceResult = ec.service.sync().name(name).parameters(arguments ?: [:]).call()
def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
// Convert result to MCP format
def content = []
if (serviceResult) {
content << [
type: "text",
text: new JsonBuilder(serviceResult).toString()
]
}
result = [
content: content,
isError: false
]
// Update audit record
artifactHit.runningTimeMillis = executionTime
artifactHit.wasError = "N"
artifactHit.outputSize = new JsonBuilder(result).toString().length()
artifactHit.update()
}
} catch (Exception e) {
def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
if (wantsStreaming) {
// Send error event with proper SSE format
def errorEvent = new JsonBuilder([
type: "error",
message: e.message,
tool: name
]).toString()
def errorEventId = UUID.randomUUID().toString()
ec.web?.response?.outputStream?.print("event: error\nid: ${errorEventId}\ndata: ${errorEvent}\n\n")
ec.web?.response?.outputStream?.flush()
result = [streamed: true, error: true]
} else {
result = [
content: [
[
type: "text",
text: "Error executing tool ${name}: ${e.message}"
]
],
isError: true
]
}
// Update audit record with error
artifactHit.runningTimeMillis = executionTime
artifactHit.wasError = "Y"
artifactHit.errorMessage = e.message
artifactHit.update()
ec.logger.error("MCP tool execution error", e)
}
]]></script>
</actions>
</service>
<service verb="handle" noun="ResourcesList" authenticate="true" allow-remote="true" transaction-timeout="60">
<description>Handle MCP resources/list request with Moqui entity discovery</description>
<in-parameters>
<parameter name="cursor"/>
</in-parameters>
<out-parameters>
<parameter name="result" type="Map"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
import groovy.json.JsonBuilder
ExecutionContext ec = context.ec
// Get all entity names from Moqui entity engine
def allEntityNames = ec.entity.getEntityNames()
def availableResources = []
// Convert entities to MCP resources
for (entityName in allEntityNames) {
try {
// Check if user has permission
if (!ec.user.hasPermission("entity:${entityName}", "VIEW")) {
continue
}
def entityInfo = ec.entity.getEntityInfo(entityName)
if (!entityInfo) continue
// Convert entity to MCP resource format
def resource = [
uri: "entity://${entityName}",
name: entityName,
description: "Moqui entity: ${entityName}",
mimeType: "application/json"
]
availableResources << resource
} catch (Exception e) {
ec.logger.warn("Error processing entity ${entityName}: ${e.message}")
}
}
result = [
resources: availableResources
]
]]></script>
</actions>
</service>
<service verb="handle" noun="ResourcesRead" authenticate="true" allow-remote="true" transaction-timeout="120">
<description>Handle MCP resources/read request with Moqui entity queries</description>
<in-parameters>
<parameter name="uri" required="true"/>
</in-parameters>
<out-parameters>
<parameter name="result" type="Map"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
import groovy.json.JsonBuilder
ExecutionContext ec = context.ec
// Check if client wants streaming by looking at Accept header
def acceptHeader = ec.web?.request?.getHeader("Accept")
def wantsStreaming = acceptHeader?.contains("text/event-stream")
// Parse entity URI (format: entity://EntityName)
if (!uri.startsWith("entity://")) {
throw new Exception("Invalid resource URI: ${uri}")
}
def entityName = uri.substring(9) // Remove "entity://" prefix
// Validate entity exists
if (!ec.entity.isEntityDefined(entityName)) {
throw new Exception("Entity not found: ${entityName}")
}
// Check permission
if (!ec.user.hasPermission("entity:${entityName}", "VIEW")) {
throw new Exception("Permission denied for entity: ${entityName}")
}
// Create audit record
def artifactHit = ec.entity.makeValue("moqui.server.ArtifactHit")
artifactHit.setSequencedIdPrimary()
artifactHit.visitId = ec.web?.visitId
artifactHit.userId = ec.user.userId
artifactHit.artifactType = "MCP"
artifactHit.artifactSubType = "Resource"
artifactHit.artifactName = "resources/read"
artifactHit.parameterString = uri
artifactHit.startDateTime = ec.user.now
artifactHit.create()
def startTime = System.currentTimeMillis()
try {
// Query entity data (limited to prevent large responses)
def entityList = ec.entity.find(entityName)
.limit(100)
.list()
def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
// Convert to MCP resource content
def contents = [
[
uri: uri,
mimeType: "application/json",
text: new JsonBuilder([
entityName: entityName,
recordCount: entityList.size(),
data: entityList
]).toString()
]
]
result = [
contents: contents
]
// Update audit record
artifactHit.runningTimeMillis = executionTime
artifactHit.wasError = "N"
artifactHit.outputSize = new JsonBuilder(result).toString().length()
artifactHit.update()
} catch (Exception e) {
def executionTime = (System.currentTimeMillis() - startTime) / 1000.0
// Update audit record with error
artifactHit.runningTimeMillis = executionTime
artifactHit.wasError = "Y"
artifactHit.errorMessage = e.message
artifactHit.update()
throw new Exception("Error reading resource ${uri}: ${e.message}")
}
]]></script>
</actions>
</service>
<service verb="handle" noun="Ping" authenticate="true" allow-remote="true" transaction-timeout="10">
<description>Handle MCP ping request for health check</description>
<in-parameters/>
<out-parameters>
<parameter name="result" type="Map"/>
</out-parameters>
<actions>
<script><![CDATA[
result = [
timestamp: ec.user.now,
status: "healthy",
version: "2.0.0"
]
]]></script>
</actions>
</service>
<!-- GET Method Support for SSE Streams -->
<service verb="handle" noun="HttpGetRequest" authenticate="true" allow-remote="true" transaction-timeout="300">
<description>Handle MCP HTTP GET requests for SSE streams (MCP 2025-06-18 compliant)</description>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
import groovy.json.JsonBuilder
import java.util.UUID
ExecutionContext ec = context.ec
// Validate Accept header - must include text/event-stream
def acceptHeader = ec.web?.request?.getHeader("Accept")
if (!acceptHeader?.contains("text/event-stream")) {
ec.web?.response?.setStatus(406) // Not Acceptable
response = "Accept header must include text/event-stream for GET requests"
return
}
// Validate Origin header for DNS rebinding protection
def originHeader = ec.web?.request?.getHeader("Origin")
if (originHeader) {
def originValid = ec.service.sync("mo-mcp.McpJsonRpcServices.isValidOrigin#Helper", [origin: originHeader, ec: ec]).isValid
if (!originValid) {
ec.web?.response?.setStatus(403) // Forbidden
response = "Invalid Origin header"
return
}
}
// Set protocol version header
ec.web?.response?.setHeader("MCP-Protocol-Version", "2025-06-18")
// Handle session management
def sessionId = ec.web?.request?.getHeader("Mcp-Session-Id")
if (!sessionId) {
ec.web?.response?.setStatus(400) // Bad Request
response = "Mcp-Session-Id header required for GET requests"
return
}
// Set SSE headers
ec.web?.response?.setContentType("text/event-stream")
ec.web?.response?.setHeader("Cache-Control", "no-cache")
ec.web?.response?.setHeader("Connection", "keep-alive")
ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control, Mcp-Session-Id, MCP-Protocol-Version")
// Handle Last-Event-ID for resumability
def lastEventId = ec.web?.request?.getHeader("Last-Event-ID")
// Start SSE stream with a ping event
def pingEvent = new JsonBuilder([
type: "ping",
timestamp: ec.user.now,
sessionId: sessionId
]).toString()
def eventId = UUID.randomUUID().toString()
response = "event: ping\nid: ${eventId}\ndata: ${pingEvent}\n\n"
// In a real implementation, you would keep the stream open and send events
// For now, we'll just send the initial ping and close
ec.message.addMessage("MCP SSE stream opened for session ${sessionId}", "info")
]]></script>
</actions>
</service>
<!-- Helper Functions -->
<service verb="validate" noun="Origin" authenticate="false" allow-remote="false">
<description>Validate Origin header for DNS rebinding protection</description>
<in-parameters>
<parameter name="origin" required="true"/>
</in-parameters>
<out-parameters>
<parameter name="isValid" type="boolean"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
ExecutionContext ec = context.ec
// Allow localhost origins
if (origin?.startsWith("http://localhost:") || origin?.startsWith("https://localhost:")) {
isValid = true
return
}
// Allow 127.0.0.1 origins
if (origin?.startsWith("http://127.0.0.1:") || origin?.startsWith("https://127.0.0.1:")) {
isValid = true
return
}
// Allow same-origin requests (check against current host)
def currentHost = ec.web?.request?.getServerName()
def currentScheme = ec.web?.request?.getScheme()
def currentPort = ec.web?.request?.getServerPort()
def expectedOrigin = "${currentScheme}://${currentHost}"
if ((currentScheme == "http" && currentPort != 80) || (currentScheme == "https" && currentPort != 443)) {
expectedOrigin += ":${currentPort}"
}
if (origin == expectedOrigin) {
isValid = true
return
}
// Check for configured allowed origins (could be from system properties)
def allowedOrigins = ec.getFactory().getConfiguration().getStringList("moqui.mcp.allowed_origins", [])
if (allowedOrigins.contains(origin)) {
isValid = true
return
}
isValid = false
]]></script>
</actions>
</service>
<service verb="convert" noun="MoquiTypeToJsonSchemaType" authenticate="true" allow-remote="true">
<description>Convert Moqui data types to JSON Schema types</description>
<in-parameters>
<parameter name="moquiType" required="true"/>
</in-parameters>
<out-parameters>
<parameter name="jsonSchemaType"/>
</out-parameters>
<actions>
<script><![CDATA[
// Simple type mapping - can be expanded as needed
def typeMap = [
"text-short": "string",
"text-medium": "string",
"text-long": "string",
"text-very-long": "string",
"id": "string",
"id-long": "string",
"number-integer": "integer",
"number-decimal": "number",
"number-float": "number",
"date": "string",
"date-time": "string",
"date-time-nano": "string",
"boolean": "boolean",
"text-indicator": "boolean"
]
jsonSchemaType = typeMap[moquiType] ?: "string"
]]></script>
</actions>
</service>
</services>
\ No newline at end of file
......@@ -120,7 +120,7 @@
def entityNames = []
// Get all entity names
def allEntityNames = ec.entity.getEntityNames()
def allEntityNames = ec.entity.getAllEntityNames()
// Filter to commonly used entities for demonstration
def commonEntities = [
......@@ -296,7 +296,7 @@
ExecutionContext ec = context.ec
// Get all service names from Moqui service engine
def allServiceNames = ec.service.getServiceNames()
def allServiceNames = ec.service.getKnownServiceNames()
def availableTools = []
// Convert services to MCP tools
......@@ -456,7 +456,7 @@
ExecutionContext ec = context.ec
// Get all entity names from Moqui entity engine
def allEntityNames = ec.entity.getEntityNames()
def allEntityNames = ec.entity.getAllEntityNames()
def availableResources = []
// Convert entities to MCP resources
......@@ -583,21 +583,109 @@
<description>Handle MCP ping request for health check</description>
<in-parameters/>
<out-parameters>
<parameter name="timestamp" type="date-time"/>
<parameter name="status" type="text-indicator"/>
<parameter name="version"/>
<parameter name="result" type="Map"/>
</out-parameters>
<actions>
<script><![CDATA[
timestamp = ec.user.getNowTimestamp()
status = "healthy"
version = "2.0.0"
result = [
timestamp: ec.user.getNowTimestamp(),
status: "healthy",
version: "2.0.0"
]
]]></script>
</actions>
</service>
<!-- Debug Service -->
<service verb="debug" noun="ComponentStatus" authenticate="false" allow-remote="true">
<description>Debug service to verify component is loaded and working</description>
<in-parameters/>
<out-parameters>
<parameter name="status" type="Map"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
ExecutionContext ec = context.ec
def status = [
componentLoaded: true,
componentName: "mo-mcp",
timestamp: ec.user.getNowTimestamp(),
user: ec.user.username,
userId: ec.user.userId,
serviceNames: ec.service.getKnownServiceNames().findAll { it.contains("Mcp") },
entityNames: ec.entity.getAllEntityNames().findAll { it.contains("ArtifactHit") }
]
ec.logger.info("=== MCP COMPONENT DEBUG ===")
ec.logger.info("Component status: ${status}")
ec.logger.info("All service names count: ${ec.service.getKnownServiceNames().size()}")
ec.logger.info("All entity names count: ${ec.entity.getAllEntityNames().size()}")
ec.logger.info("=== END MCP COMPONENT DEBUG ===")
result.status = status
]]></script>
</actions>
</service>
<!-- Helper Functions -->
<service verb="validate" noun="Origin" authenticate="false" allow-remote="false">
<description>Validate Origin header for DNS rebinding protection</description>
<in-parameters>
<parameter name="origin" required="true"/>
</in-parameters>
<out-parameters>
<parameter name="isValid" type="boolean"/>
</out-parameters>
<actions>
<script><![CDATA[
import org.moqui.context.ExecutionContext
ExecutionContext ec = context.ec
// Allow localhost origins
if (origin?.startsWith("http://localhost:") || origin?.startsWith("https://localhost:")) {
isValid = true
return
}
// Allow 127.0.0.1 origins
if (origin?.startsWith("http://127.0.0.1:") || origin?.startsWith("https://127.0.0.1:")) {
isValid = true
return
}
// Allow same-origin requests (check against current host)
def currentHost = ec.web?.request?.getServerName()
def currentScheme = ec.web?.request?.getScheme()
def currentPort = ec.web?.request?.getServerPort()
def expectedOrigin = "${currentScheme}://${currentHost}"
if ((currentScheme == "http" && currentPort != 80) || (currentScheme == "https" && currentPort != 443)) {
expectedOrigin += ":${currentPort}"
}
if (origin == expectedOrigin) {
isValid = true
return
}
// Check for configured allowed origins (could be from system properties)
def allowedOrigins = ec.getFactory().getConfiguration().getStringList("moqui.mcp.allowed_origins", [])
if (allowedOrigins.contains(origin)) {
isValid = true
return
}
isValid = false
]]></script>
</actions>
</service>
<service verb="convert" noun="MoquiTypeToJsonSchemaType" authenticate="false">
<description>Convert Moqui data types to JSON Schema types</description>
<in-parameters>
......@@ -648,17 +736,136 @@
<script><![CDATA[
import groovy.json.JsonBuilder
import org.moqui.context.ExecutionContext
import java.util.UUID
ExecutionContext ec = context.ec
// Check Accept header to determine if client wants streaming response
// DEBUG: Log initial request details
ec.logger.info("=== MCP REQUEST DEBUG START ===")
ec.logger.info("MCP Request - Method: ${method}, ID: ${id}")
ec.logger.info("MCP Request - Params: ${params}")
ec.logger.info("MCP Request - User: ${ec.user.username}, UserID: ${ec.user.userId}")
ec.logger.info("MCP Request - Current Time: ${ec.user.getNowTimestamp()}")
// DEBUG: Log HTTP request details
def httpRequest = ec.web?.request
if (httpRequest) {
ec.logger.info("HTTP Method: ${httpRequest.method}")
ec.logger.info("HTTP Content-Type: ${httpRequest.getContentType()}")
ec.logger.info("HTTP Accept: ${httpRequest.getHeader('Accept')}")
ec.logger.info("HTTP Origin: ${httpRequest.getHeader('Origin')}")
ec.logger.info("HTTP User-Agent: ${httpRequest.getHeader('User-Agent')}")
ec.logger.info("HTTP Remote Addr: ${httpRequest.getRemoteAddr()}")
ec.logger.info("HTTP Request URL: ${httpRequest.getRequestURL()}")
ec.logger.info("HTTP Query String: ${httpRequest.getQueryString()}")
} else {
ec.logger.warn("HTTP Request object is null!")
}
// DEBUG: Log HTTP response details
if (httpResponse) {
ec.logger.info("HTTP Response Status: ${httpResponse.status}")
} else {
ec.logger.warn("HTTP Response object is null!")
}
// Validate HTTP method - only POST allowed for JSON-RPC messages
def httpMethod = ec.web?.request?.method
ec.logger.info("Validating HTTP method: ${httpMethod}")
if (httpMethod != "POST") {
ec.logger.warn("Invalid HTTP method: ${httpMethod}, expected POST")
ec.web?.response?.setStatus(405) // Method Not Allowed
ec.web?.response?.setHeader("Allow", "POST")
response = "Method Not Allowed. Use POST for JSON-RPC messages."
return
}
ec.logger.info("HTTP method validation passed")
// Validate Content-Type header for POST requests
def contentType = ec.web?.request?.getContentType()
ec.logger.info("Validating Content-Type: ${contentType}")
if (!contentType?.contains("application/json")) {
ec.logger.warn("Invalid Content-Type: ${contentType}, expected application/json")
ec.web?.response?.setStatus(415) // Unsupported Media Type
response = "Content-Type must be application/json for JSON-RPC messages"
return
}
ec.logger.info("Content-Type validation passed")
// Validate Accept header - must accept application/json for MVP
def acceptHeader = ec.web?.request?.getHeader("Accept")
def wantsStreaming = acceptHeader && acceptHeader.contains("text/event-stream")
ec.logger.info("Validating Accept header: ${acceptHeader}")
if (!acceptHeader?.contains("application/json")) {
ec.logger.warn("Invalid Accept header: ${acceptHeader}")
ec.web?.response?.setStatus(406) // Not Acceptable
response = "Accept header must include application/json for JSON-RPC"
return
}
ec.logger.info("Accept header validation passed")
// Validate Content-Type header for POST requests
if (!contentType?.contains("application/json")) {
ec.web?.response?.setStatus(415) // Unsupported Media Type
response = "Content-Type must be application/json for JSON-RPC messages"
return
}
// Validate Origin header for DNS rebinding protection
def originHeader = ec.web?.request?.getHeader("Origin")
ec.logger.info("Checking Origin header: ${originHeader}")
if (originHeader) {
try {
def originValid = ec.service.sync("mo-mcp.McpServices.validate#Origin", [origin: originHeader]).isValid
ec.logger.info("Origin validation result: ${originValid}")
if (!originValid) {
ec.logger.warn("Invalid Origin header rejected: ${originHeader}")
ec.web?.response?.setStatus(403) // Forbidden
response = "Invalid Origin header"
return
}
} catch (Exception e) {
ec.logger.error("Error during Origin validation", e)
ec.web?.response?.setStatus(500) // Internal Server Error
response = "Error during Origin validation: ${e.message}"
return
}
} else {
ec.logger.info("No Origin header present")
}
// Force non-streaming for MVP - always use JSON-RPC 2.0
def wantsStreaming = false
ec.logger.info("Streaming disabled for MVP - using JSON-RPC 2.0")
// Set protocol version header on all responses
ec.web?.response?.setHeader("MCP-Protocol-Version", "2025-06-18")
ec.logger.info("Set MCP protocol version header")
// Handle session management
def sessionId = ec.web?.request?.getHeader("Mcp-Session-Id")
def isInitialize = (method == "initialize")
ec.logger.info("Session management - SessionId: ${sessionId}, IsInitialize: ${isInitialize}")
if (!isInitialize && !sessionId) {
ec.logger.warn("Missing session ID for non-initialization request")
ec.web?.response?.setStatus(400) // Bad Request
response = "Mcp-Session-Id header required for non-initialization requests"
return
}
// Generate new session ID for initialization
if (isInitialize) {
def newSessionId = UUID.randomUUID().toString()
ec.web?.response?.setHeader("Mcp-Session-Id", newSessionId)
ec.logger.info("Generated new session ID: ${newSessionId}")
}
ec.logger.info("MCP ${method} :: ${params} STREAMING ${wantsStreaming}")
// Validate JSON-RPC version
ec.logger.info("Validating JSON-RPC version: ${jsonrpc}")
if (jsonrpc && jsonrpc != "2.0") {
ec.logger.warn("Invalid JSON-RPC version: ${jsonrpc}")
def errorResponse = new JsonBuilder([
jsonrpc: "2.0",
error: [
......@@ -668,13 +875,18 @@
id: id
]).toString()
ec.logger.info("Built JSON-RPC error response: ${errorResponse}")
if (wantsStreaming) {
response = "data: ${errorResponse}\n\n"
response = "event: error\ndata: ${errorResponse}\n\n"
ec.logger.info("Returning streaming error response")
} else {
response = errorResponse
ec.logger.info("Returning regular error response")
}
return
}
ec.logger.info("JSON-RPC version validation passed")
def result = null
def error = null
......@@ -682,32 +894,40 @@
try {
// Map OpenCode method names to actual service names
def serviceName = null
ec.logger.info("Mapping method '${method}' to service name")
switch (method) {
case "mcp#Ping":
case "ping":
serviceName = "McpServices.mcp#Ping"
ec.logger.info("Mapped to service: ${serviceName}")
break
case "initialize":
case "mcp#Initialize":
serviceName = "McpServices.mcp#Initialize"
ec.logger.info("Mapped to service: ${serviceName}")
break
case "tools/list":
case "mcp#ToolsList":
serviceName = "McpServices.mcp#ToolsList"
ec.logger.info("Mapped to service: ${serviceName}")
break
case "tools/call":
case "mcp#ToolsCall":
serviceName = "McpServices.mcp#ToolsCall"
ec.logger.info("Mapped to service: ${serviceName}")
break
case "resources/list":
case "mcp#ResourcesList":
serviceName = "McpServices.mcp#ResourcesList"
ec.logger.info("Mapped to service: ${serviceName}")
break
case "resources/read":
case "mcp#ResourcesRead":
serviceName = "McpServices.mcp#ResourcesRead"
ec.logger.info("Mapped to service: ${serviceName}")
break
default:
ec.logger.warn("Unknown method: ${method}")
error = [
code: -32601,
message: "Method not found: ${method}"
......@@ -715,12 +935,29 @@
}
if (serviceName && !error) {
// Call the actual MCP service (services now return Maps, no streaming logic)
result = ec.service.sync().name(serviceName).parameters(params ?: [:]).call()
ec.logger.info("Calling service: ${serviceName} with params: ${params}")
// Check if service exists before calling
if (!ec.service.isServiceDefined(serviceName)) {
ec.logger.error("Service not defined: ${serviceName}")
error = [
code: -32601,
message: "Service not found: ${serviceName}"
]
} else {
// Call the actual MCP service (services now return Maps, no streaming logic)
def serviceStartTime = System.currentTimeMillis()
result = ec.service.sync().name(serviceName).parameters(params ?: [:]).call()
def serviceEndTime = System.currentTimeMillis()
ec.logger.info("Service ${serviceName} completed in ${serviceEndTime - serviceStartTime}ms")
ec.logger.info("Service result type: ${result?.getClass()?.getSimpleName()}")
ec.logger.info("Service result: ${result}")
}
}
} catch (Exception e) {
ec.logger.error("MCP request error for method ${method}", e)
ec.logger.error("Exception details: ${e.getClass().getName()}: ${e.message}")
ec.logger.error("Exception stack trace: ${e.getStackTrace()}")
error = [
code: -32603,
message: "Internal error: ${e.message}"
......@@ -728,6 +965,7 @@
}
// Build JSON-RPC response
ec.logger.info("Building JSON-RPC response")
def responseObj = [
jsonrpc: "2.0",
id: id
......@@ -735,23 +973,29 @@
if (error) {
responseObj.error = error
ec.logger.info("Response includes error: ${error}")
} else {
responseObj.result = result
ec.logger.info("Response includes result")
}
def jsonResponse = new JsonBuilder(responseObj).toString()
if (wantsStreaming) {
// Set streaming headers and return as Server-Sent Events
ec.web?.response?.setContentType("text/event-stream")
ec.web?.response?.setHeader("Cache-Control", "no-cache")
ec.web?.response?.setHeader("Connection", "keep-alive")
ec.web?.response?.setHeader("Access-Control-Allow-Origin", "*")
ec.web?.response?.setHeader("Access-Control-Allow-Headers", "Cache-Control")
response = "data: ${jsonResponse}\n\n"
} else {
response = jsonResponse
}
ec.logger.info("Built JSON response: ${jsonResponse}")
ec.logger.info("JSON response length: ${jsonResponse.length()}")
def httpResponse = ec.web?.response
// MVP: Always return JSON-RPC 2.0, no streaming
ec.logger.info("Creating JSON-RPC 2.0 response")
if (httpResponse) {
httpResponse.setContentType("application/json")
httpResponse.setHeader("Content-Type", "application/json")
ec.logger.info("Set JSON-RPC content type")
}
response = jsonResponse
ec.logger.info("Created JSON-RPC response, length: ${response.length()}")
ec.logger.info("=== MCP REQUEST DEBUG END ===")
]]></script>
</actions>
</service>
......
......@@ -15,12 +15,23 @@
description="MCP JSON-RPC 2.0 services for Moqui integration">
<resource name="rpc">
<method type="post">
<method type="post" content-type="application/json">
<service name="McpServices.handle#McpRequest"/>
</method>
<method type="post" content-type="application/json-rpc">
<service name="McpServices.handle#McpRequest"/>
</method>
<method type="get">
<service name="McpServices.mcp#Ping"/>
</method>
<method type="get" path="debug">
<service name="McpServices.debug#ComponentStatus"/>
</method>
<!-- Add a catch-all method for debugging -->
<method type="post">
<service name="McpServices.handle#McpRequest"/>
</method>
</resource>
......