docs(java-mcp): document tool name rules, URL elicitation, authorization, and Jackson 3 mapper

- Add the tool name rules of specification revision 2025-11-25 (SEP-986).
  The server builder rejects an incorrect name. addTool() does not check it.
- Add URL mode elicitation with ElicitUrlRequest (SEP-1036).
- State that the SDK has no authorization for remote servers.
- State that the mcp artifact contains mcp-core and mcp-json-jackson3.
  Remove the Jackson 2 option.
This commit is contained in:
Burak Kaygusuz
2026-10-09 07:25:08 +03:00
parent c93b398ab3
commit 908458b050
4 changed files with 12 additions and 4 deletions
@@ -113,5 +113,6 @@ The starter serves the endpoint at `/mcp`.
- For WebFlux, declare a `WebFluxStreamableServerTransportProvider` bean in the same way. Its builder uses `messageEndpoint("/mcp")`, not `mcpEndpoint`.
- Embedded Tomcat listens on all network interfaces. For a public host, add its name to `allowedHost`. Put authentication in front of the server.
- The SDK has no authorization. For a remote server, add authorization in a servlet filter or with Spring Security.
- `HttpServletStatelessServerTransport` makes a server without sessions. Use it with `McpServer.sync(transport)` when more than one replica must answer the requests. A stateless server cannot send requests to the client. Also set `securityValidator` on its builder.
- For browser clients, add CORS to the servlet container. Allow the `Mcp-*` request headers. Expose the `Mcp-Session-Id` response header.