CAMEL-24310: camel-mcp-server - verify main HTTP server authentication protects the MCP endpoint

[Croway]

Test-only follow-up to CAMEL-24310 / #25306, closing the open verification item from that PR's description: does the main HTTP server's camel.server.authentication* configuration also protect the MCP endpoint?

It does — now proven at runtime. The mechanism: VertxPlatformHttpServer mounts the basic/JWT authentication handlers on its sub-router at the default path /* during server init, and the VertxPlatformHttpRouter bound in the registry delegates to that same sub-router — so the /mcp routes the MCP engine registers later sit behind the auth handlers (Vert.x dispatches in insertion order).

McpServerMainAuthenticationTest boots Main with camel.server.authentication-enabled=true + basic-properties-file and asserts:

• unauthenticated POST / GET / DELETE on /mcp → 401 (all three registered routes covered)
• the full MCP conversation (initialize, tag-filtered tools/list, tools/call) succeeds with Basic credentials, supplied via the MCP SDK client's httpRequestCustomizer

Full camel-mcp-server module suite green (10 tests).

---

This PR was written by Claude Code on behalf of Federico Mariani (@Croway).

🤖 Generated with Claude Code

[davsclaus]

Clean test-only follow-up that closes the verification gap from #25306 — confirms camel.server.authentication* configuration protects the /mcp endpoint at runtime.

Conventions check:

• ✅ Package-private test class and methods (JUnit 5 convention)
• ✅ AssertJ assertions throughout
• ✅ No Thread.sleep()
• ✅ Proper resource management (Main via @BeforeAll/@AfterAll, McpSyncClient in try-finally)
• ✅ License headers, imports, AI attribution

LGTM.

This review was generated by an AI agent (Claude Code on behalf of davsclaus) and may contain inaccuracies. Please verify all suggestions before applying.

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[github-actions]

🧪 CI tested the following changed modules:

• components/camel-ai/camel-mcp-server

---

🔬 Scalpel shadow comparison — Scalpel: 1 tested, 0 compile-only — current: 9 all tested

Maveniverse Scalpel detected 1 affected modules (current approach: 9).

Modules only in current approach (8)

• camel-jbang-mcp
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-launcher-container
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin

Skip-tests mode would test 1 modules (1 direct + 0 downstream), skip tests for 0 (generated code, meta-modules)

Modules Scalpel would test (1)

• camel-mcp-server

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

⚠️ Some tests are disabled on GitHub Actions (@DisabledIfSystemProperty(named = "ci.env.name")) and require manual verification:

• components/camel-ai/camel-mcp-server: 1 test(s) disabled on GitHub Actions

All tested modules (9 modules)

• Camel :: AI :: MCP Server
• Camel :: JBang :: MCP
• Camel :: JBang :: Plugin :: MCP
• Camel :: JBang :: Plugin :: Route Parser
• Camel :: JBang :: Plugin :: TUI
• Camel :: JBang :: Plugin :: Validate
• Camel :: Launcher :: Container
• Camel :: YAML DSL :: Validator
• Camel :: YAML DSL :: Validator Maven Plugin

---

⚙️ View full build and test results