![\"\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261021083250-6ad878b264e85.png\")
<\/p>\n<dependencyManagement>
\n <dependencies>
\n <dependency>
\n <groupId>org.springframework.ai<\/groupId>
\n <artifactId>spring-ai-bom<\/artifactId>
\n <version>2.0.1<\/version>
\n <type>pom<\/type>
\n <scope>import<\/scope>
\n <\/dependency>
\n <\/dependencies>
\n<\/dependencyManagement>
\n<dependencies>
\n <dependency>
\n <groupId>org.springframework.boot<\/groupId>
\n <artifactId>spring-boot-starter-web<\/artifactId>
\n <\/dependency>
\n <!– Security \u7528\u4e8eBearer\u9274\u6743 –>
\n <dependency>
\n <groupId>org.springframework.boot<\/groupId>
\n <artifactId>spring-boot-starter-security<\/artifactId>
\n <\/dependency>
\n <!– MCP Server WebMvc Streamable HTTP –>
\n <dependency>
\n <groupId>org.springframework.ai<\/groupId>
\n <artifactId>spring-ai-starter-mcp-server-webmvc<\/artifactId>
\n <\/dependency>
\n <!– Spring AI 2.x \u4e2d spring-ai-core \u5df2\u66f4\u540d\u4e3a spring-ai-model，\u63d0\u4f9b @Tool –>
\n <dependency>
\n <groupId>org.springframework.ai<\/groupId>
\n <artifactId>spring-ai-model<\/artifactId>
\n <\/dependency>
\n<\/dependencies> <\/p>\n
\u914d\u7f6e\u6587\u4ef6\u5728application.yml<\/p>\n
spring:
\n ai:
\n mcp:
\n server:
\n name: zkbmpt #MCP\u670d\u52a1\u540d\u79f0
\n version: 0.0.1 #MCP \u670d\u52a1\u7248\u672c\u53f7
\n type: SYNC #\u5de5\u5177\u6267\u884c\u6a21\u578b，\u9009\u503c：`SYNC`（\u540c\u6b65\u6267\u884c） \/ `ASYNC`（\u5f02\u6b65\u6d41\u5f0f\u6267\u884c）
\n protocol: STREAMABLE #MCP \u5e95\u5c42\u4f20\u8f93\u534f\u8bae，\u53ef\u9009\u503c：`SSE` \/ `STREAMABLE`（Streamable HTTP Transport）
\n #MCP \u670d\u52a1\u6307\u4ee4\u3001\u7cfb\u7edf\u63d0\u793a\u6587\u672c
\n instructions: |
\n \u8fd9\u662f\u62a5\u540d\u7cfb\u7edf\u7ba1\u7406MCP\u670d\u52a1，\u63d0\u4f9b\u62a5\u540d\u5355\u67e5\u8be2\u3001\u65b0\u589e\u3001\u5ba1\u6838\u5de5\u5177\u3002
\n \u8c03\u7528\u5de5\u5177\u524d\u786e\u8ba4\u53c2\u6570，\u5ba1\u6838\u7c7b\u64cd\u4f5c\u8c28\u614e\u6267\u884c\u3002
\n annotation-scanner:
\n enabled: true #\u6ce8\u89e3\u81ea\u52a8\u626b\u63cf\u5f00\u5173
\n# \u81ea\u5b9a\u4e49MCP Bearer\u5bc6\u94a5
\nmcp:
\n auth-token: sk-xxxx
\n# \u8c03\u8bd5\u65e5\u5fd7，\u67e5\u770bMCP\u62a5\u6587\u3001\u5de5\u5177\u6ce8\u518c
\nlogging:
\n level:
\n org.springframework.ai.mcp: DEBUG
\n org.springframework.security: WARN <\/p>\n
package com.example.demo.mcp.config;<\/p>\n
import jakarta.servlet.FilterChain;
\nimport jakarta.servlet.ServletException;
\nimport jakarta.servlet.http.HttpServletRequest;
\nimport jakarta.servlet.http.HttpServletResponse;
\nimport org.springframework.beans.factory.annotation.Value;
\nimport org.springframework.context.annotation.Bean;
\nimport org.springframework.context.annotation.Configuration;
\nimport org.springframework.http.HttpMethod;
\nimport org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
\nimport org.springframework.security.config.annotation.web.builders.HttpSecurity;
\nimport org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
\nimport org.springframework.security.config.http.SessionCreationPolicy;
\nimport org.springframework.security.core.authority.AuthorityUtils;
\nimport org.springframework.security.core.context.SecurityContextHolder;
\nimport org.springframework.security.web.SecurityFilterChain;
\nimport org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
\nimport org.springframework.web.filter.OncePerRequestFilter;<\/p>\n
import java.io.IOException;<\/p>\n
@Configuration
\n@EnableWebSecurity
\npublic class McpSecurityConfig {<\/p>\n
@Value("${mcp.auth-token}")
\n private String validToken;<\/p>\n
@Bean
\n public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
\n http
\n .csrf(csrf -> csrf.disable())
\n .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
\n .authorizeHttpRequests(auth -> auth
\n .requestMatchers(HttpMethod.OPTIONS, "\/mcp", "\/mcp\/**").permitAll()
\n .requestMatchers("\/mcp", "\/mcp\/**").authenticated()
\n .anyRequest().permitAll())
\n .addFilterBefore(new BearerTokenFilter(validToken), BasicAuthenticationFilter.class);
\n return http.build();
\n }<\/p>\n
static class BearerTokenFilter extends OncePerRequestFilter {
\n private final String expectToken;<\/p>\n
public BearerTokenFilter(String expectToken) {
\n this.expectToken = expectToken;
\n }<\/p>\n
@Override
\n protected boolean shouldNotFilter(HttpServletRequest request) {
\n if (HttpMethod.OPTIONS.matches(request.getMethod())) {
\n return true;
\n }
\n String uri = request.getRequestURI();
\n return !"\/mcp".equals(uri) && !uri.startsWith("\/mcp\/");
\n }<\/p>\n
@Override
\n protected void doFilterInternal(HttpServletRequest request,
\n HttpServletResponse response,
\n FilterChain filterChain) throws ServletException, IOException {
\n String authHeader = request.getHeader("Authorization");
\n if (authHeader == null || !authHeader.startsWith("Bearer ")) {
\n response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
\n response.setContentType("application\/json;charset=utf-8");
\n response.getWriter().write("{\\\\"code\\\\":401,\\\\"msg\\\\":\\\\"\u7f3a\u5c11Authorization Bearer\u8bf7\u6c42\u5934\\\\"}");
\n return;
\n }
\n String token = authHeader.substring(7);
\n if (!expectToken.equals(token)) {
\n response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
\n response.setContentType("application\/json;charset=utf-8");
\n response.getWriter().write("{\\\\"code\\\\":401,\\\\"msg\\\\":\\\\"Token\u65e0\u6548\\\\"}");
\n return;
\n }
\n var authentication = new UsernamePasswordAuthenticationToken(
\n "mcp-client", null, AuthorityUtils.createAuthorityList("ROLE_MCP"));
\n SecurityContextHolder.getContext().setAuthentication(authentication);
\n filterChain.doFilter(request, response);
\n }
\n }
\n}<\/p>\n
package com.example.demo.mcp.config;<\/p>\n
import org.springframework.context.annotation.Configuration;
\nimport org.springframework.web.servlet.config.annotation.CorsRegistry;
\nimport org.springframework.web.servlet.config.annotation.WebMvcConfigurer;<\/p>\n
@Configuration
\npublic class McpCorsConfig implements WebMvcConfigurer {
\n @Override
\n public void addCorsMappings(CorsRegistry registry) {
\n registry.addMapping("\/mcp")
\n .allowedOriginPatterns("*")
\n .allowedMethods("GET", "POST", "OPTIONS")
\n .allowedHeaders("*")
\n .allowCredentials(false)
\n .maxAge(3600);
\n }
\n}<\/p>\n
package com.example.demo.mcp.config;<\/p>\n
import io.modelcontextprotocol.common.McpTransportContext;
\nimport org.springframework.ai.mcp.server.webmvc.transport.WebMvcStreamableServerTransportProvider;
\nimport org.springframework.context.annotation.Bean;
\nimport org.springframework.context.annotation.Configuration;<\/p>\n
import java.util.HashMap;
\nimport java.util.Map;<\/p>\n
@Configuration
\npublic class McpTransportConfig {
\n @Bean
\n public WebMvcStreamableServerTransportProvider transportProvider() {
\n return WebMvcStreamableServerTransportProvider.builder()
\n .contextExtractor(serverRequest -> {
\n Map<String, Object> ctxMap = new HashMap<>();
\n String authHeader = serverRequest.headers().firstHeader("Authorization");
\n ctxMap.put("Authorization", authHeader);
\n return McpTransportContext.create(ctxMap);
\n })
\n .build();
\n }
\n}<\/p>\n
package com.example.demo.mcp.service;<\/p>\n
import org.springframework.ai.mcp.annotation.McpTool;
\nimport org.springframework.ai.mcp.annotation.McpToolParam;
\nimport org.springframework.stereotype.Service;<\/p>\n
import java.time.LocalDateTime;
\nimport java.time.ZoneId;<\/p>\n
@Service
\npublic class McpToolService {
\n @McpTool(name = "serverTime", description = "\u8fd4\u56de\u670d\u52a1\u5f53\u524d\u65f6\u95f4（Asia\/Shanghai）")
\n public String serverTime() {
\n return LocalDateTime.now(ZoneId.of("Asia\/Shanghai")).toString();
\n }<\/p>\n
@McpTool(name = "query", description = "\u8003\u751f\u4fe1\u606f\u67e5\u8be2")
\n public String query(
\n @McpToolParam(description = "\u8003\u751f\u59d3\u540d", required = true) String name,
\n @McpToolParam(description = "\u5b66\u53f7", required = true) String studentNo) {
\n \/\/\u5177\u4f53\u7684\u4e1a\u52a1\u903b\u8f91
\n return "\u8003\u751f：" + name + ",\u5b66\u53f7：" + studentNo;
\n }
\n}<\/p>\n
\u4f7f\u7528\u00a0MCP Inspector\u00a0\u5de5\u5177\u8fdb\u884cmcp\u670d\u52a1\u8c03\u8bd5<\/p>\n
<\/p>\n
\u9009\u62e9stramable-http<\/p>\n
![\"\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261021083251-6ad878b334b5f.png\")
<\/p>\n
![\"\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261021083251-6ad878b34e02f.png\")
<\/p>\n<\/p>\n
![\"\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261021083251-6ad878b364bba.png\")
<\/p>\n
![\"\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261021083251-6ad878b381dc6.png\")
<\/p>\n
![\"\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261021083251-6ad878b396fed.png\")
<\/p>\n
![\"\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261021083252-6ad878b4315bf.png\")
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e00：\u4f9d\u8d56\u5b89\u88c5
\norg.springframework.aispring-ai-bom2.0.1pomimport
\n<\/depend<\/p>\n","protected":false},"author":2,"featured_media":116501,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[53,99,98,292],"topic":[],"class_list":["post-116508","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-ai","tag-java","tag-spring-boot","tag-292"],"yoast_head":"\n