implement http transport in client and server (#79)

Author: simonpcouch

CLAUDE.md

@@ -46,3 +46,63 @@ The server uses a condition variable (`cv`) to coordinate multiple async operati
 - Server dials to `inproc://mcptools-session-1` by default
 - `inproc://` transport is fast for same-machine communication
 - Connections are cleaned up with `nanonext::reap()` on exit
+
+## HTTP Transport Implementation
+
+### Current Status
+
+The HTTP transport implementation follows the "MUSTs only" principle from the MCP specification:
+
+**Implemented (MUSTs):**
+- HTTP POST endpoint for JSON-RPC messages
+- `MCP-Protocol-Version` header validation
+- Origin validation for DNS rebinding protection
+- Client-side session ID tracking (if server provides `Mcp-Session-Id` header)
+- GET endpoint (returns 405 - SSE streaming not implemented)
+
+**Not Implemented (MAYs/SHOULDs):**
+- Server-side session management (MAY in spec)
+- SSE streaming for GET requests (optional)
+- OAuth 2.1 authentication (OPTIONAL in spec)
+- HTTPS/TLS support
+
+### HTTP vs HTTPS
+
+**Protocol Requirements:**
+- The MCP protocol does NOT require HTTPS for authless HTTP servers
+- HTTPS is only REQUIRED for OAuth/authorization endpoints (which we don't implement)
+
+**Client Compatibility:**
+- **Claude Code**: Works with `http://` servers ✓
+- **Claude Desktop**: Requires `https://` servers (product policy, not protocol requirement) ✗
+
+Since HTTPS requires SSL certificates (self-signed for local dev, proper certs for production),
+we defer HTTPS support until OAuth 2.1 is implemented, when it becomes a MUST.
+
+### Testing with the Inspector
+
+The MCP inspector helps test MCP servers:
+
+```bash
+Rscript -e "mcptools::mcp_server(type = 'http', port = 9000)"
+```
+
+Then:
+
+```bash
+npx @modelcontextprotocol/inspector --transport http --server-url http://127.0.0.1:9000
+```
+
+### Using with Claude Code
+
+Add the HTTP server to Claude Code:
+
+```bash
+claude mcp add --transport http r-mcptools-http http://127.0.0.1:9000
+```
+
+Remove it:
+
+```bash
+claude mcp remove r-mcptools-http
+```

DESCRIPTION

@@ -24,9 +24,11 @@ URL: https://github.com/posit-dev/mcptools,
 BugReports: https://github.com/posit-dev/mcptools/issues
 Depends: 
     R (>= 4.1.0)
-Imports: 
+Imports:
     cli,
     ellmer (>= 0.3.0),
+    httpuv,
+    httr2,
     jsonlite,
     nanonext (>= 1.6.0),
     processx,

NEWS.md

@@ -1,5 +1,9 @@
 # mcptools (development version)
 
+* `mcp_server()` now supports HTTP transport in addition to stdio. Use `type = "http"` to start an HTTP server, with optional `host` and `port` arguments. For now, the implementation is authless.
+
+* `mcp_tools()` now supports connecting to HTTP-based MCP servers. Configure servers with a `url` field in the config file instead of `command`/`args`.
+
 * JSON-RPC responses now retain an explicit `id = NULL` value, ensuring parse-error replies conform to the MCP specification.
 
 * `mcp_server()` now formats tool results in the same way as ellmer (#78 by @gadenbuie).

R/client.R

@@ -38,12 +38,12 @@ the$mcp_servers <- list()
 #' file with `file.edit(file.path("~", ".config", "mcptools", "config.json"))`.
 #'
 #' The mcptools config file should be valid .json with an entry `mcpServers`.
-#' That entry should contain named elements, each with at least a `command`
-#' and `args` entry.
+#' That entry should contain named elements, each configured for either
+#' **stdio** or **HTTP** transport.
 #'
-#' For example, to configure `mcp_tools()` with GitHub's official MCP Server
-#' <https://github.com/github/github-mcp-server>, you could write the following
-#' in that file:
+#' ## Local servers (via stdio)
+#'
+#' For stdio-based servers, provide `command` and `args` entries:
 #'
 #' ```json
 #' {
@@ -66,6 +66,23 @@ the$mcp_servers <- list()
 #' }
 #' ```
 #'
+#' ## Remote servers (via http)
+#'
+#' For HTTP-based servers, provide a `url` entry instead of `command`/`args`:
+#'
+#' ```json
+#' {
+#'   "mcpServers": {
+#'     "local-http": {
+#'       "url": "https://localhost:8080"
+#'     },
+#'     "remote-http": {
+#'       "url": "https://mcp.example.com/mcp"
+#'     }
+#'   }
+#' }
+#' ```
+#'
 #' @returns
 #' * `mcp_tools()` returns a list of ellmer tools that can be passed directly
 #' to the `$set_tools()` method of an [ellmer::Chat] object. If the file at
@@ -100,33 +117,91 @@ mcp_tools <- function(config = NULL) {
   for (i in seq_along(config)) {
     config_i <- config[[i]]
     name_i <- names(config)[i]
-    config_i_env <- if ("env" %in% names(config_i)) {
-      unlist(config_i$env)
+
+    if ("url" %in% names(config_i)) {
+      add_mcp_server_http(config = config_i, name = name_i)
     } else {
-      NULL
+      add_mcp_server_stdio(config = config_i, name = name_i)
     }
+  }
 
-    process <- processx::process$new(
-      # seems like the R process has a different PATH than process_exec
-      command = Sys.which(config_i$command),
-      args = config_i$args,
-      env = config_i_env,
-      stdin = "|",
-      stdout = "|",
-      stderr = "|"
-    )
+  servers_as_ellmer_tools()
+}
 
-    the$server_processes <- c(
-      the$server_processes,
-      list2(
-        !!paste0(c(config_i$command, config_i$args), collapse = " ") := process
-      )
+add_mcp_server_stdio <- function(config, name) {
+  config_env <- if ("env" %in% names(config)) {
+    unlist(config$env)
+  } else {
+    NULL
+  }
+
+  process <- processx::process$new(
+    command = Sys.which(config$command),
+    args = config$args,
+    env = config_env,
+    stdin = "|",
+    stdout = "|",
+    stderr = "|"
+  )
+
+  the$server_processes <- c(
+    the$server_processes,
+    list2(
+      !!paste0(c(config$command, config$args), collapse = " ") := process
     )
+  )
 
-    add_mcp_server(process = process, name = name_i)
-  }
+  response_initialize <- send_and_receive_stdio(
+    process,
+    mcp_request_initialize()
+  )
+  send_and_receive_stdio(process, mcp_request_initialized())
+  response_tools_list <- send_and_receive_stdio(
+    process,
+    mcp_request_tools_list()
+  )
 
-  servers_as_ellmer_tools()
+  the$mcp_servers[[name]] <- list(
+    name = name,
+    type = "stdio",
+    process = process,
+    tools = response_tools_list$result,
+    id = 3
+  )
+
+  the$mcp_servers[[name]]
+}
+
+add_mcp_server_http <- function(config, name) {
+  response_initialize <- send_and_receive_http(
+    url = config$url,
+    request = mcp_request_initialize()
+  )
+
+  session_id <- response_initialize$session_id
+
+  send_and_receive_http(
+    url = config$url,
+    request = mcp_request_initialized(),
+    session_id = session_id
+  )
+
+  response_tools_list <- send_and_receive_http(
+    url = config$url,
+    request = mcp_request_tools_list(),
+    session_id = session_id
+  )
+
+  the$mcp_servers[[name]] <- list(
+    name = name,
+    type = "http",
+    url = config$url,
+    session_id = session_id,
+    tools = response_tools_list$result,
+    id = 3
+  )
+
+  the$mcp_servers[[name]]
 }
 
 mcp_client_config <- function() {
@@ -193,19 +268,34 @@ error_no_mcp_config <- function(call) {
   )
 }
 
-add_mcp_server <- function(process, name) {
-  response_initialize <- send_and_receive(process, mcp_request_initialize())
-  send_and_receive(process, mcp_request_initialized())
-  response_tools_list <- send_and_receive(process, mcp_request_tools_list())
+send_and_receive_http <- function(url, request, session_id = NULL) {
+  req <- httr2::request(url) |>
+    httr2::req_method("POST") |>
+    httr2::req_headers(
+      "Content-Type" = "application/json",
+      "Accept" = "application/json",
+      "MCP-Protocol-Version" = "2025-06-18"
+    ) |>
+    httr2::req_body_json(request)
+
+  if (!is.null(session_id)) {
+    req <- httr2::req_headers(req, "Mcp-Session-Id" = session_id)
+  }
+
+  resp <- httr2::req_perform(req)
 
-  the$mcp_servers[[name]] <- list(
-    name = name,
-    process = process,
-    tools = response_tools_list$result,
-    id = 3
-  )
+  if (httr2::resp_status(resp) == 202L || httr2::resp_body_string(resp) == "") {
+    return(NULL)
+  }
 
-  the$mcp_servers[[name]]
+  body <- httr2::resp_body_json(resp)
+
+  session_id_header <- httr2::resp_header(resp, "Mcp-Session-Id")
+  if (!is.null(session_id_header)) {
+    body$session_id <- session_id_header
+  }
+
+  body
 }
 
 servers_as_ellmer_tools <- function() {
@@ -347,13 +437,21 @@ tool_ref <- function(server, tool, arguments) {
 }
 
 call_tool <- function(..., server, tool) {
-  server_process <- the$mcp_servers[[server]]$process
-  send_and_receive(
-    server_process,
-    mcp_request_tool_call(
-      id = jsonrpc_id(server),
-      tool = tool,
-      arguments = list(...)
+  server_config <- the$mcp_servers[[server]]
+
+  request <- mcp_request_tool_call(
+    id = jsonrpc_id(server),
+    tool = tool,
+    arguments = list(...)
+  )
+
+  switch(
+    server_config$type,
+    stdio = send_and_receive_stdio(server_config$process, request),
+    http = send_and_receive_http(
+      url = server_config$url,
+      request = request,
+      session_id = server_config$session_id
     )
   )
 }
@@ -372,13 +470,11 @@ log_cat_client <- function(x, append = TRUE) {
   cat(x, "\n\n", sep = "", append = append, file = log_file)
 }
 
-send_and_receive <- function(process, message) {
-  # send the message
+send_and_receive_stdio <- function(process, message) {
   json_msg <- jsonlite::toJSON(message, auto_unbox = TRUE)
   log_cat_client(c("FROM CLIENT: ", json_msg))
   process$write_input(paste0(json_msg, "\n"))
 
-  # poll for response
   output <- NULL
   attempts <- 0
   max_attempts <- 20