test(integration): Add Streamable HTTP transport integration tests #486

jskjw157 · 2026-01-20T09:29:47Z

Summary

Add integration tests for Prompts, Resources, and Tools over Streamable HTTP transport as outlined in #183.

Changes

Infrastructure: Enable STREAMABLE_HTTP transport in test base
Prompts: Add functional and security integration tests
Resources: Add functional and security integration tests
Tools: Add functional and security integration tests

Related Issue

Fixes partially #183, #332

kpavlov

Thanks, @jskjw157!
Could we take a look at the test scenarios and see, if we can move any use cases that aren’t specific to the protocol to the base class?
Also, could we tidy up those long TODO comments?
Let’s give another go, this time with a focus on making the tests easier to maintain.

...t/src/jvmTest/kotlin/io/modelcontextprotocol/kotlin/sdk/integration/kotlin/KotlinTestBase.kt

...Test/kotlin/io/modelcontextprotocol/kotlin/sdk/integration/utils/MockAuthorizationWrapper.kt

...ntextprotocol/kotlin/sdk/integration/kotlin/streamablehttp/StreamableHttpToolSpecificTest.kt

...mTest/kotlin/io/modelcontextprotocol/kotlin/sdk/integration/utils/StreamableHttpTestUtils.kt

...xtprotocol/kotlin/sdk/integration/kotlin/streamablehttp/ToolIntegrationTestStreamableHttp.kt

jskjw157 · 2026-01-21T23:40:29Z

Fixed in 97f1fa9

kpavlov

Please rebase onto main and squash the commits so we maintain a clear commit history.

...commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/server/StreamableHttpServerTransport.kt

jskjw157 · 2026-01-22T14:29:56Z

Done! Rebased onto main and squashed the commits.

Are there any other issues or features you'd recommend I work on next?

- Add StreamableHTTP transport support to KotlinTestBase - Add Prompt/Resource/Tool integration tests for StreamableHTTP - Add security integration tests (transport-neutral, STDIO-based) - Add StreamableHttpTestUtils and MockAuthorizationWrapper utilities - Unify mcp-session-id header casing across test files

kpavlov

Thanks, @jskjw157!

While this PR does add some useful integration tests for the Streamable HTTP protocol, the security tests could use a bit more thought.

To start, I’d suggest moving the security tests to a separate PR and keeping this one focused on adding Streamable HTTP transport support to the existing tests (we can remove the ‘Security tests’ tag).

The access control system isn’t quite ready to go on the server yet, but we’re running some tests to check it out a bit early. Also, the list resource tests should make sure that resources are only shown to users who have the right to see them. Maybe we could replace MockAuthorizationWrapper with something more like a production-code solution, such as a chain of generic (resource+principal)-aware predicates. You might want to have a look at Spring Security, where you can find examples of how these ideas are put into action.

TL;DR - Let's remove security tests from this PR and keep it focused on adding Streamable HTTP protocol tests.

kpavlov · 2026-01-26T12:07:39Z

...t/src/jvmTest/kotlin/io/modelcontextprotocol/kotlin/sdk/integration/kotlin/KotlinTestBase.kt

    private var stdioClientOutput: Sink? = null

+    // StreamableHTTP-specific fields
+    private var streamableHttpServerTransport: StreamableHttpServerTransport? = null


Just a heads-up: this should probably be in the streamable test subclass, but since we already have transport-specific fields here, let’s tackle it separately.

kpavlov · 2026-01-26T12:40:26Z

...textprotocol/kotlin/sdk/integration/kotlin/security/AbstractPromptSecurityIntegrationTest.kt

+    private val secretPromptName = "secret-prompt"
+    private val restrictedPromptName = "restricted-prompt"


I don't see any difference between "secret" and "restricted" in this scenario

kpavlov · 2026-01-26T12:46:06Z

...textprotocol/kotlin/sdk/integration/kotlin/security/AbstractPromptSecurityIntegrationTest.kt

+        assertTrue(promptNames.contains(secretPromptName), "Secret prompt should be listed")
+        assertTrue(promptNames.contains(restrictedPromptName), "Restricted prompt should be listed")


I do not expect the server to return restricted resources in a list, unless access to the resources is granted. But the current server implementation does not support that, unfortunately. These 2 checks should be removed / commented

kpavlov · 2026-01-26T12:46:38Z

...textprotocol/kotlin/sdk/integration/kotlin/security/AbstractPromptSecurityIntegrationTest.kt

+    fun testListPromptsDenied() {
+        runBlocking {
+            val result = client.listPrompts()
+            assertNotNull(result, "List prompts should succeed")
+        }
+    }


This test does not redundant

kpavlov · 2026-01-26T12:50:06Z

...textprotocol/kotlin/sdk/integration/kotlin/security/AbstractPromptSecurityIntegrationTest.kt

+    @Test
+    fun testGetPromptPartialAccess(): Unit = runBlocking {
+        val publicResult = client.getPrompt(
+            GetPromptRequest(
+                GetPromptRequestParams(
+                    name = publicPromptName,
+                    arguments = emptyMap(),
+                ),
+            ),
+        )
+        assertNotNull(publicResult, "Public prompt should be accessible")
+
+        val restrictedResult = client.getPrompt(
+            GetPromptRequest(
+                GetPromptRequestParams(
+                    name = restrictedPromptName,
+                    arguments = emptyMap(),
+                ),
+            ),
+        )
+        assertNotNull(restrictedResult, "Restricted prompt should be accessible")
+
+        val exception = assertThrows<McpException> {
+            runBlocking {
+                client.getPrompt(
+                    GetPromptRequest(
+                        GetPromptRequestParams(
+                            name = secretPromptName,
+                            arguments = emptyMap(),
+                        ),
+                    ),
+                )
+            }
+        }
+
+        withClue("Secret prompt should be denied") {
+            exception.message?.lowercase()?.contains("access denied") shouldBe true
+        }
+    }


It should have been a test per use case, not a single test

kpavlov · 2026-01-26T12:57:13Z

...Test/kotlin/io/modelcontextprotocol/kotlin/sdk/integration/utils/MockAuthorizationWrapper.kt

+ * )
+ *
+ * server.addPrompt(...) { request ->
+ *     if (!authWrapper.isAllowed("prompts", "get", mapOf("name" to request.params.name))) {


Would this API be even better?

authWrapper.isAllowed(…) // throws exception

kpavlov · 2026-01-26T13:05:39Z

...Test/kotlin/io/modelcontextprotocol/kotlin/sdk/integration/utils/MockAuthorizationWrapper.kt

I would recommend having a look at Spring Security and implementing something like ResourceAuthorizer – a predicate that accepts the currently authenticated user and the resources and returns an authentication decision: ACCEPTED/DENIED/UNKNOWN. For test simplicity, it could return just a boolean.

kpavlov · 2026-01-26T13:06:42Z

...mTest/kotlin/io/modelcontextprotocol/kotlin/sdk/integration/utils/StreamableHttpTestUtils.kt

+    // TODO: Future utilities for advanced testing scenarios
+
+    // TODO: Creates a custom HTTP client with specific headers for testing.
+    //
+    // This would be useful for testing:
+    // - Invalid session IDs
+    // - Custom Host/Origin headers for DNS rebinding tests
+    // - Missing required headers
+    //
+    // Implementation requires creating a Ktor HttpClient with custom configuration.
+    // fun createCustomHttpClient(customHeaders: Map<String, String>): HttpClient
+
+    // TODO: Sends a direct HTTP request to the server for low-level testing.
+    //
+    // This would be useful for testing:
+    // - Malformed requests
+    // - Invalid JSON
+    // - HTTP-level errors (404, 403, 400, etc.)
+    //
+    // Implementation requires direct Ktor client usage outside of MCP client abstraction.
+    // suspend fun sendDirectHttpRequest(url: String, method: HttpMethod, headers: Map<String, String>, body: String?): HttpResponse
+
+    // TODO: Creates a StreamableHTTP client with a pre-set session ID.
+    //
+    // This would be useful for testing:
+    // - Session resumption
+    // - Invalid session ID handling
+    // - Session expiration scenarios
+    //
+    // Implementation requires ability to inject session ID into client transport.
+    // fun createClientWithSessionId(url: String, sessionId: String): Client
+
+    // TODO: Asserts that a request was rejected with a specific HTTP status code.
+    //
+    // This would be useful for testing:
+    // - Authorization failures (403)
+    // - Invalid requests (400)
+    // - Not found errors (404)
+    //
+    // Implementation requires catching and analyzing transport-level errors.


Let’s take out the comment to keep the code tidy.

kpavlov · 2026-01-26T13:08:31Z

...xtprotocol/kotlin/sdk/integration/kotlin/security/AbstractResourceSecurityIntegrationTest.kt

+import kotlin.test.assertNotNull
+import kotlin.test.assertTrue
+
+abstract class AbstractResourceSecurityIntegrationTest : KotlinTestBase() {


See my comments to AbstractPromptSecurityIntegrationTest

kpavlov · 2026-01-26T13:08:44Z

...ontextprotocol/kotlin/sdk/integration/kotlin/security/AbstractToolSecurityIntegrationTest.kt

+import kotlin.test.assertNotNull
+import kotlin.test.assertTrue
+
+abstract class AbstractToolSecurityIntegrationTest : KotlinTestBase() {


See my comments to AbstractPromptSecurityIntegrationTest

jskjw157 force-pushed the test/streamable-http-integration branch from e71221c to 56cd2d7 Compare January 20, 2026 09:31

kpavlov reviewed Jan 20, 2026

View reviewed changes

kpavlov added the tests label Jan 20, 2026

kpavlov reviewed Jan 22, 2026

View reviewed changes

...commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/server/StreamableHttpServerTransport.kt Show resolved Hide resolved

kpavlov force-pushed the test/streamable-http-integration branch from 97f1fa9 to 921bed3 Compare January 22, 2026 07:19

jskjw157 force-pushed the test/streamable-http-integration branch 2 times, most recently from c2a5d9f to 8e9557c Compare January 22, 2026 13:46

kpavlov force-pushed the test/streamable-http-integration branch from 8e9557c to e253b80 Compare January 26, 2026 06:47

kpavlov requested changes Jan 26, 2026

View reviewed changes

		private val secretPromptName = "secret-prompt"
		private val restrictedPromptName = "restricted-prompt"

		assertTrue(promptNames.contains(secretPromptName), "Secret prompt should be listed")
		assertTrue(promptNames.contains(restrictedPromptName), "Restricted prompt should be listed")

test(integration): Add Streamable HTTP transport integration tests #486

Are you sure you want to change the base?

test(integration): Add Streamable HTTP transport integration tests #486

Uh oh!

Conversation

jskjw157 commented Jan 20, 2026 • edited by kpavlov Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Related Issue

Uh oh!

kpavlov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jskjw157 commented Jan 21, 2026

Uh oh!

kpavlov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jskjw157 commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kpavlov left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jskjw157 commented Jan 20, 2026 •

edited by kpavlov

Loading

jskjw157 commented Jan 22, 2026 •

edited

Loading