Spring MCP Client security not working when controller exposes streaming HTTP endpoint #19
Description
When the MCP client is exposed through a Flux-based streaming HTTP endpoint, the thread-bound request context does not appear to be propagated correctly.
In this scenario, calls to RequestContextHolder.getRequestAttributes() within AuthenticationMcpTransportContextProvider.java consistently return null.
It seems that the thread architecture used in reactive endpoints (WebFlux) does not maintain the same request context as in traditional WebMVC controllers.
@GetMapping("/stream-chat")
public Flux<String> index(@RequestParam(required = false) String query) {
if (StringUtils.hasText(query)) {
String prompt = String.format("""
What is the weather in %s right now?
Compare to historical data over the past 5 years.
Concisely tell me if it is within the usual range.
Format the output in plain HTML, no CSS.
""", query);
return RequestContextReactorHelper.withRequestContext(
chatClient.prompt(prompt)
.toolCallbacks(mcpToolCallbacks)
.stream()
.call()
.content()
);
}
return Flux.just("no query");
}