| Filename | Latest commit message | Latest commit date |
|---|---|---|
Bumps [io.ktor:ktor-bom](https://github.com/ktorio/ktor) from 3.5.1 to 3.5.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ktorio/ktor/releases">io.ktor:ktor-bom's releases</a>.</em></p> <blockquote> <h2>3.5.2</h2> <blockquote> <p>Published 31 July 2026</p> </blockquote> <h3>Improvements</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-8032">KTOR-8032</a> RateLimit: Allow limit requests based on authentication result</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9719">KTOR-9719</a> <code>ApplicationCall.isStaticContent</code> returns false when called from plugin interceptors</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-8450">KTOR-8450</a> ContentNegotiation: it doesn't handle content type suffixes</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-7892">KTOR-7892</a> SwaggerUI: Missing oauth2-redirect.html support in the plugin</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9759">KTOR-9759</a> Reject whitespace in URL hosts during parsing</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9681">KTOR-9681</a> Update kotlinx-io to 0.9.1</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9743">KTOR-9743</a> ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9504">KTOR-9504</a> Improve KDoc for EmbeddedServer.addShutdownHook</li> </ul> <h3>Bugfixes</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9741">KTOR-9741</a> CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-7661">KTOR-7661</a> Maven + YAML config file does not work</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9585">KTOR-9585</a> OpenAPI: JsonSchema title is truncated when it contains a dot</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9704">KTOR-9704</a> UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9588">KTOR-9588</a> SSE client (CIO engine) sends spurious <code>Content-Length: 0</code> on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9679">KTOR-9679</a> ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9767">KTOR-9767</a> ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count <a href="#"><img src="https://img.shields.io/badge/%5BImpactful%20change%5D-orange?style=flat-square" alt="" /></a></li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-8992">KTOR-8992</a> HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9698">KTOR-9698</a> OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9690">KTOR-9690</a> Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-8903">KTOR-8903</a> Netty: Close channel connection on errors properly</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9707">KTOR-9707</a> SaveBody performance regression</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9703">KTOR-9703</a> Inefficient text reading function in DefaultTransform</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9711">KTOR-9711</a> Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9688">KTOR-9688</a> RateLimit: No access to principal when wrapped with authentication since 3.5.1</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9677">KTOR-9677</a> Auto-reloading: server is reloaded only once since 3.5.0</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9683">KTOR-9683</a> Sockets: Canceling a SelectorManager job doesn't close it properly</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9671">KTOR-9671</a> Darwin: Semicolons in URL path are sanitized</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ktorio/ktor/blob/main/CHANGELOG.md">io.ktor:ktor-bom's changelog</a>.</em></p> <blockquote> <h1>3.5.2</h1> <blockquote> <p>Published 31 July 2026</p> </blockquote> <h3>Improvements</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-8032">KTOR-8032</a> RateLimit: Allow limit requests based on authentication result</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9719">KTOR-9719</a> <code>ApplicationCall.isStaticContent</code> returns false when called from plugin interceptors</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-8450">KTOR-8450</a> ContentNegotiation: it doesn't handle content type suffixes</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-7892">KTOR-7892</a> SwaggerUI: Missing oauth2-redirect.html support in the plugin</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9759">KTOR-9759</a> Reject whitespace in URL hosts during parsing</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9681">KTOR-9681</a> Update kotlinx-io to 0.9.1</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9743">KTOR-9743</a> ByteReadChannel.readLineStrict: Misleading definition of limit parameter in KDocs</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9504">KTOR-9504</a> Improve KDoc for EmbeddedServer.addShutdownHook</li> </ul> <h3>Bugfixes</h3> <ul> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9741">KTOR-9741</a> CIO: request-handler coroutine leak on half-closed idle connection after ≥1MB response</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-7661">KTOR-7661</a> Maven + YAML config file does not work</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9585">KTOR-9585</a> OpenAPI: JsonSchema title is truncated when it contains a dot</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9704">KTOR-9704</a> UTF-8 encoding in ktor-io bypasses JVM String.getBytes intrinsics, slowing every text response by 5-7x</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9588">KTOR-9588</a> SSE client (CIO engine) sends spurious <code>Content-Length: 0</code> on body-less GET (RFC 9110 § 8.6 violation; rejected by AWS ELB)</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9679">KTOR-9679</a> ByteReadChannel.readLine corrupts multi-byte UTF-8 by splitting a character at a buffer boundary</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9767">KTOR-9767</a> ByteReadChannel.readLineTo: Return read bytes count instead of decoded characters count <a href="#"><img src="https://img.shields.io/badge/%5BImpactful%20change%5D-orange?style=flat-square" alt="" /></a></li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-8992">KTOR-8992</a> HoconConfigLoader is not loaded when ktor-server-config-yaml on the classpath</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9698">KTOR-9698</a> OpenAPI: schema for kotlinx.serialization sealed types omits discriminator property in variant schemas</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9690">KTOR-9690</a> Netty: in-flight requests are aborted on stop(), ignoring shutdown grace period</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-8903">KTOR-8903</a> Netty: Close channel connection on errors properly</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9707">KTOR-9707</a> SaveBody performance regression</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9703">KTOR-9703</a> Inefficient text reading function in DefaultTransform</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9711">KTOR-9711</a> Netty HTTP/2: a single client-canceled stream (RST_STREAM) breaks response flushing for the whole connection</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9688">KTOR-9688</a> RateLimit: No access to principal when wrapped with authentication since 3.5.1</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9677">KTOR-9677</a> Auto-reloading: server is reloaded only once since 3.5.0</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9683">KTOR-9683</a> Sockets: Canceling a SelectorManager job doesn't close it properly</li> <li><a href="https://youtrack.jetbrains.com/issue/KTOR-9671">KTOR-9671</a> Darwin: Semicolons in URL path are sanitized</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
| .. | ||
| gradle | ||
| src | ||
| build.gradle.kts | ||
| gradle.properties | ||
| gradlew | ||
| gradlew.bat | ||
| README.md | ||
| settings.gradle.kts | ||
Simple Streamable HTTP Server
A minimal MCP server using the recommended Streamable HTTP transport with optional Bearer token authentication.
Overview
This sample demonstrates a Streamable HTTP MCP server built with Ktor. It exposes tools, a prompt
template, and a resource over HTTP, and optionally supports Bearer token authentication. The
multi-greet tool showcases server-to-client logging notifications with streaming delays.
Prerequisites
- JDK 17+
Build & Run
Without authentication
./gradlew run
The server starts on http://localhost:3001/mcp by default.
Connect with the MCP Inspector:
npx @modelcontextprotocol/inspector
In the Inspector UI, select Streamable HTTP transport and enter http://localhost:3001/mcp.
Pass a port number as an argument to change it:
./gradlew run --args="8080"
With authentication
MCP_AUTH_TOKEN=my-secret ./gradlew run --args="--auth"
When --auth is passed, clients must include an Authorization: Bearer <token> header.
The token is read from the MCP_AUTH_TOKEN environment variable (required when --auth is used).
Authentication caveats
This sample is intended for demonstration only. In production you should:
- Use a proper identity provider instead of a static token.
- Restrict CORS origins to your deployment domain — the sample allows all origins.
- Serve the endpoint over HTTPS.
MCP Capabilities
Tools
| Name | Description |
|---|---|
greet |
Returns a greeting for a given name. |
multi-greet |
Sends logging notifications between delayed greetings, demonstrating streaming. |
Prompts
| Name | Description |
|---|---|
greeting-template |
Generates a friendly greeting message for a given name. |
Resources
| Name | URI | Description |
|---|---|---|
Default Greeting |
https://example.com/greetings/default |
Returns a static "Hello, world!" text. |