feat: serve over streamable HTTP with per-request credentials - #38
Open
zvikagart wants to merge 3 commits into
Open
feat: serve over streamable HTTP with per-request credentials#38zvikagart wants to merge 3 commits into
zvikagart wants to merge 3 commits into
Conversation
Add a --transport streamable-http mode that serves many users from one process, resolving the Code Ocean client from each request's 'Authorization: Bearer <token>' header via a request-scoped client proxy, so the tool definitions stay untouched. Requests without a token are refused rather than served with the environment's token. The stdio transport with CODEOCEAN_TOKEN remains the default and is unchanged.
There was a problem hiding this comment.
Pull request overview
Adds a new streamable-HTTP transport option so a single codeocean-mcp-server process can serve multiple callers, resolving Code Ocean credentials per request from the HTTP Authorization header while keeping the existing stdio behavior unchanged.
Changes:
- Introduces
--transport streamable-http(plus--host/--port) and runs FastMCP in stateless HTTP mode. - Adds a request-scoped
CodeOceanclient proxy with an LRU cache to reuse connection pools per token. - Adds end-to-end tests for per-request credential isolation and updates README usage docs.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
tests/test_http_transport.py |
Adds E2E coverage for streamable-HTTP, per-request tokens, and tool parity with stdio. |
src/codeocean_mcp_server/server.py |
Adds CLI parsing and wires streamable-HTTP transport + request-scoped client behavior. |
src/codeocean_mcp_server/client.py |
Implements per-request token extraction and cached client creation. |
README.md |
Documents how to run and call the server over streamable HTTP. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Rewrite the Authorization header parse as an explicit scheme guard - the conditional expression it replaces read as if the scheme check could be skipped, and a test now covers a token offered under a non-Bearer scheme. Report only the variables actually required for the chosen transport, so streamable-HTTP no longer claims CODEOCEAN_TOKEN must be set.
zvikagart
commented
Aug 20, 2026
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
doronsl
approved these changes
Aug 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets a single server process serve many users, so callers (notably the Code Ocean agent) can run one shared server instead of spawning one subprocess per invocation.
Changes
--transport streamable-httpmode (with--host/--port), served withstateless_http=True.stdioremains the default; running the server with onlyCODEOCEAN_TOKENandCODEOCEAN_DOMAINexported from Claude Desktop or Cursor is unchanged.CodeOceanclient is now resolved per request in HTTP mode, from the request'sAuthorization: Bearerheader, via a request-scoped proxy. Tools keep closing over a singleclientobject, so all 26 tool definitions, their names, input schemas and descriptions are untouched.