HTTPS

[kate-tortubekova]

Hello, and thank you for your work on this library!

I’m building a custom MCP server based on php-mcp/serve, using HttpServerTransport with HTTP+SSE. I’m encountering an issue when the client makes a request over HTTPS, the server responds via plain HTTP.

I suspect this behavior is related to the sslContext parameter passed to the HttpServerTransport. However, the documentation doesn’t specify what exact value or configuration is expected for enabling HTTPS. Could you please clarify what should be passed to the sslContext argument to make the transport work correctly over HTTPS?

Also, I’d like to extend the HttpServerTransport class to customize the SSE handling logic, specifically the handleSseRequest() method. Would you consider making some of the methods (like handleSseRequest) protected instead of private to support inheritance?

Thank you so much for your attention and participation.

[CodeWithKyrian]

Hi @kate-tortubekova, thanks for reaching out ! I appreciate your questions.

1. HTTPS and sslContext:

You're on the right track! To enable HTTPS, the sslContext parameter in HttpServerTransport needs to be an array configuring PHP's SSL stream context. The key options are:

$sslContextOptions = [
    'ssl' => [ // This 'ssl' key is essential
        'local_cert'        => '/path/to/your/fullchain.pem', // Your server certificate + intermediates
        'local_pk'          => '/path/to/your/private.key',
        // 'passphrase'     => 'your_private_key_password', // If your key is encrypted
        // 'allow_self_signed' => true,                   // For dev/testing with self-signed certs
    ]
];

$transport = new HttpServerTransport(
    // ... host, port, prefix ...
    sslContext: $sslContextOptions
);

Ensure the paths to your certificate (local_cert) and private key (local_pk) are correct and readable by the PHP process. For production, please use a certificate from a trusted CA. If the server still responds over HTTP when an HTTPS request is made, it usually means the SSL context wasn't correctly applied (e.g., incorrect paths, certificate/key issues, or the outer 'ssl' key missing in the context array). You can find all available options in the PHP manual for SSL context options.

2. Extending HttpServerTransport:

That's a perfectly valid use case, and I appreciate the suggestion! I'm currently working on refactoring for an upcoming release to support StreamableHttp Transport. I'll make sure to change the visibility to protected in both by then. Does that work for you?