Croway opened a new pull request, #25328: URL: https://github.com/apache/camel/pull/25328
Test-only follow-up to [CAMEL-24310](https://issues.apache.org/jira/browse/CAMEL-24310) / #25306, closing the open verification item from that PR's description: does the main HTTP server's `camel.server.authentication*` configuration also protect the MCP endpoint? **It does — now proven at runtime.** The mechanism: `VertxPlatformHttpServer` mounts the basic/JWT authentication handlers on its sub-router at the default path `/*` during server init, and the `VertxPlatformHttpRouter` bound in the registry delegates to that same sub-router — so the `/mcp` routes the MCP engine registers later sit behind the auth handlers (Vert.x dispatches in insertion order). `McpServerMainAuthenticationTest` boots `Main` with `camel.server.authentication-enabled=true` + `basic-properties-file` and asserts: - unauthenticated `POST` / `GET` / `DELETE` on `/mcp` → **401** (all three registered routes covered) - the full MCP conversation (initialize, tag-filtered `tools/list`, `tools/call`) succeeds with Basic credentials, supplied via the MCP SDK client's `httpRequestCustomizer` Full `camel-mcp-server` module suite green (10 tests). --- _This PR was written by Claude Code on behalf of Federico Mariani (@Croway)._ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
