@eclipse-glsp/server-mcp 2.7.0-next.9 → 2.8.0-next.0

package/lib/node/server/node-mcp-server-launcher.d.ts

@@ -0,0 +1,55 @@
+/********************************************************************************
+ * Copyright (c) 2025-2026 EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+import * as http from 'http';
+import { AddressInfo } from 'net';
+import { AbstractMcpServerLauncher, FullMcpServerConfiguration, TransportEndpoint } from '../../common/server/abstract-mcp-server-launcher';
+export { FullMcpServerConfiguration, TransportEndpoint } from '../../common/server/abstract-mcp-server-launcher';
+/**
+ * Stdout tag used to announce the started MCP server so IDE integrations can pick up the URL
+ * automatically. The full line is `MCP_SERVER_READY_MSG + JSON.stringify({name, url, route})`.
+ */
+export declare const MCP_SERVER_READY_MSG = "[GLSP-MCP-Server]:Ready. ";
+/**
+ * Returns true iff `host` is a loopback bind: `localhost`, `::1`, or any IPv4 in
+ * `127.0.0.0/8`. Any other value (`0.0.0.0`, `::`, LAN/public addresses) is non-loopback.
+ * Used by {@link assertLoopbackOrAcknowledged} for the auth-footgun runtime check.
+ */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Refuse to bind on a non-loopback host unless the operator has acknowledged that traffic is
+ * authenticated externally (reverse proxy, mTLS, ACL). The MCP server has no built-in auth.
+ * Exported for regression tests only; not part of the public surface.
+ */
+export declare function assertLoopbackOrAcknowledged(host: string, acknowledgedNoAuth: boolean | undefined): void;
+/**
+ * Boots the embedded MCP HTTP server when a GLSP `initialize` call carries an `mcpServer`
+ * configuration. Runs in-process via the {@link GLSPServerInitializer} lifecycle. The portable
+ * per-session multiplexer + handler dispatch lives on {@link AbstractMcpServerLauncher}; this
+ * subclass only binds the Node HTTP listener via `@hono/node-server`, runs the loopback-auth
+ * guard, and announces the URL via {@link MCP_SERVER_READY_MSG}.
+ */
+export declare class NodeMcpServerLauncher extends AbstractMcpServerLauncher {
+    protected bindTransport(config: FullMcpServerConfiguration): Promise<TransportEndpoint>;
+    /**
+     * Start the Hono-on-Node listener, returning the underlying Node `http.Server` once it is
+     * listening. Translates `EADDRINUSE` into an actionable error naming the offending port
+     * and the override path adopters reach for first (`mcpServer.port` in `initialize`).
+     */
+    protected startListener(handler: (req: Request) => Promise<Response>, config: FullMcpServerConfiguration): Promise<http.Server>;
+    protected resolveAddress(server: http.Server): AddressInfo;
+    protected toServerUrl({ address, family, port }: AddressInfo, route: string, protocol?: string): string;
+}
+//# sourceMappingURL=node-mcp-server-launcher.d.ts.map

package/lib/node/server/node-mcp-server-launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-mcp-server-launcher.d.ts","sourceRoot":"","sources":["../../../src/node/server/node-mcp-server-launcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;kFAckF;AAKlF,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,kDAAkD,CAAC;AAG5I,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,kDAAkD,CAAC;AAEjH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAWxG;AAED;;;;;;GAMG;AACH,qBACa,qBAAsB,SAAQ,yBAAyB;cAChD,aAAa,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAuB7F;;;;OAIG;IACH,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;IAqB/H,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,WAAW;IAQ1D,SAAS,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,MAAM;CAI1G"}

package/lib/node/server/node-mcp-server-launcher.js

@@ -0,0 +1,123 @@
+"use strict";
+/********************************************************************************
+ * Copyright (c) 2025-2026 EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeMcpServerLauncher = exports.MCP_SERVER_READY_MSG = void 0;
+exports.isLoopbackHost = isLoopbackHost;
+exports.assertLoopbackOrAcknowledged = assertLoopbackOrAcknowledged;
+const server_1 = require("@eclipse-glsp/server");
+const node_server_1 = require("@hono/node-server");
+const inversify_1 = require("inversify");
+const abstract_mcp_server_launcher_1 = require("../../common/server/abstract-mcp-server-launcher");
+/**
+ * Stdout tag used to announce the started MCP server so IDE integrations can pick up the URL
+ * automatically. The full line is `MCP_SERVER_READY_MSG + JSON.stringify({name, url, route})`.
+ */
+exports.MCP_SERVER_READY_MSG = '[GLSP-MCP-Server]:Ready. ';
+/**
+ * Returns true iff `host` is a loopback bind: `localhost`, `::1`, or any IPv4 in
+ * `127.0.0.0/8`. Any other value (`0.0.0.0`, `::`, LAN/public addresses) is non-loopback.
+ * Used by {@link assertLoopbackOrAcknowledged} for the auth-footgun runtime check.
+ */
+function isLoopbackHost(host) {
+    return host === 'localhost' || host === '::1' || /^127\./.test(host);
+}
+/**
+ * Refuse to bind on a non-loopback host unless the operator has acknowledged that traffic is
+ * authenticated externally (reverse proxy, mTLS, ACL). The MCP server has no built-in auth.
+ * Exported for regression tests only; not part of the public surface.
+ */
+function assertLoopbackOrAcknowledged(host, acknowledgedNoAuth) {
+    if (isLoopbackHost(host) || acknowledgedNoAuth === true) {
+        return;
+    }
+    throw new Error(`Refusing to bind MCP server to non-loopback host '${host}' without authentication. ` +
+        'The MCP server has no built-in auth; binding to a non-loopback interface exposes an ' +
+        'unauthenticated MCP endpoint to the network. If this is intentional (e.g., the endpoint ' +
+        'is fronted by a reverse proxy, mTLS, or a network ACL that authenticates traffic), set ' +
+        '`acknowledgedNoAuth: true` on the McpServerDefaults you pass to the server module.');
+}
+/**
+ * Boots the embedded MCP HTTP server when a GLSP `initialize` call carries an `mcpServer`
+ * configuration. Runs in-process via the {@link GLSPServerInitializer} lifecycle. The portable
+ * per-session multiplexer + handler dispatch lives on {@link AbstractMcpServerLauncher}; this
+ * subclass only binds the Node HTTP listener via `@hono/node-server`, runs the loopback-auth
+ * guard, and announces the URL via {@link MCP_SERVER_READY_MSG}.
+ */
+let NodeMcpServerLauncher = class NodeMcpServerLauncher extends abstract_mcp_server_launcher_1.AbstractMcpServerLauncher {
+    async bindTransport(config) {
+        // Auth-footgun guard: refuse non-loopback bind unless the operator opted in via
+        // `acknowledgedNoAuth`. Runs BEFORE the listener binds so a careless `host: '0.0.0.0'`
+        // doesn't get a chance to expose an unauthenticated endpoint.
+        assertLoopbackOrAcknowledged(config.host, config.options.acknowledgedNoAuth);
+        const handler = this.getRequestHandler();
+        const server = await this.startListener(handler, config);
+        // Disable the per-request timeout so long-lived SSE GET streams aren't killed during
+        // chat idle periods. Node's default 5-minute `requestTimeout` (>=18.1) treats SSE as
+        // a single in-progress request and tears the socket whenever no events flow for ≥5 min.
+        server.requestTimeout = 0;
+        const addressInfo = this.resolveAddress(server);
+        const url = this.toServerUrl(addressInfo, config.route);
+        this.toDispose.push(server_1.Disposable.create(() => server.close()));
+        // stdout ready-marker for parent processes to discover the URL. Uses `console.log`
+        // (not the GLSP logger) so adopter logger config can never hide it.
+        console.log(exports.MCP_SERVER_READY_MSG + JSON.stringify({ name: config.name, url, route: config.route }));
+        return { url };
+    }
+    /**
+     * Start the Hono-on-Node listener, returning the underlying Node `http.Server` once it is
+     * listening. Translates `EADDRINUSE` into an actionable error naming the offending port
+     * and the override path adopters reach for first (`mcpServer.port` in `initialize`).
+     */
+    startListener(handler, config) {
+        return new Promise((resolve, reject) => {
+            const server = (0, node_server_1.serve)({ fetch: handler, port: config.port, hostname: config.host });
+            server.once('error', err => {
+                const nodeErr = err;
+                if (nodeErr.code === 'EADDRINUSE') {
+                    const portLabel = config.port === 0 ? 'requested address' : `${config.host}:${config.port}`;
+                    reject(new Error(`MCP server cannot bind ${portLabel}: address already in use. ` +
+                        'Pass a different `mcpServer.port` in the GLSP `initialize` call, or omit the port to get a random one.'));
+                    return;
+                }
+                reject(err);
+            });
+            server.once('listening', () => resolve(server));
+        });
+    }
+    resolveAddress(server) {
+        const address = server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error(`MCP server unexpectedly bound to ${String(address)} — expected an AddressInfo.`);
+        }
+        return address;
+    }
+    toServerUrl({ address, family, port }, route, protocol = 'http') {
+        const host = address === '::' || address === '0.0.0.0' ? 'localhost' : family === 'IPv6' ? `[${address}]` : address;
+        return `${protocol}://${host}:${port}${route}`;
+    }
+};
+exports.NodeMcpServerLauncher = NodeMcpServerLauncher;
+exports.NodeMcpServerLauncher = NodeMcpServerLauncher = __decorate([
+    (0, inversify_1.injectable)()
+], NodeMcpServerLauncher);
+//# sourceMappingURL=node-mcp-server-launcher.js.map

package/lib/node/server/node-mcp-server-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-mcp-server-launcher.js","sourceRoot":"","sources":["../../../src/node/server/node-mcp-server-launcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;kFAckF;;;;;;;;;AAuBlF,wCAEC;AAOD,oEAWC;AAzCD,iDAAkD;AAClD,mDAA0C;AAC1C,yCAAuC;AAGvC,mGAA4I;AAK5I;;;GAGG;AACU,QAAA,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAY;IACvC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,IAAY,EAAE,kBAAuC;IAC9F,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO;IACX,CAAC;IACD,MAAM,IAAI,KAAK,CACX,qDAAqD,IAAI,4BAA4B;QACjF,sFAAsF;QACtF,0FAA0F;QAC1F,yFAAyF;QACzF,oFAAoF,CAC3F,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,wDAAyB;IACtD,KAAK,CAAC,aAAa,CAAC,MAAkC;QAC5D,gFAAgF;QAChF,uFAAuF;QACvF,8DAA8D;QAC9D,4BAA4B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAE7E,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,qFAAqF;QACrF,qFAAqF;QACrF,wFAAwF;QACxF,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;QAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE7D,mFAAmF;QACnF,oEAAoE;QACpE,OAAO,CAAC,GAAG,CAAC,4BAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpG,OAAO,EAAE,GAAG,EAAE,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACO,aAAa,CAAC,OAA4C,EAAE,MAAkC;QACpG,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,MAAM,GAAG,IAAA,mBAAK,EAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAgB,CAAC;YAClG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACvB,MAAM,OAAO,GAAG,GAA4B,CAAC;gBAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAChC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5F,MAAM,CACF,IAAI,KAAK,CACL,0BAA0B,SAAS,4BAA4B;wBAC3D,wGAAwG,CAC/G,CACJ,CAAC;oBACF,OAAO;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACP,CAAC;IAES,cAAc,CAAC,MAAmB;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAES,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAe,EAAE,KAAa,EAAE,QAAQ,GAAG,MAAM;QAC1F,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACpH,OAAO,GAAG,QAAQ,MAAM,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;IACnD,CAAC;CACJ,CAAA;AA9DY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,sBAAU,GAAE;GACA,qBAAqB,CA8DjC"}

package/node.d.ts

@@ -0,0 +1,16 @@
+/********************************************************************************
+ * Copyright (c) 2026 EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+export * from './lib/node/index';

package/{src/util/index.ts → node.js}

@@ -13,6 +13,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
  ********************************************************************************/
+'use strict';
 
-export * from './markdown-util';
-export * from './mcp-util';
+module.exports = require('./lib/node/index');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@eclipse-glsp/server-mcp",
-  "version": "2.7.0-next.9+a58ea45",
-  "description": "Extension of the GLSP Node Server for the Model Context Protocol",
+  "version": "2.8.0-next.0+bb0b4e8",
+  "description": "Model Context Protocol (MCP) server for the GLSP TypeScript server — runs on Node, browser, and Fetch-API runtimes",
   "keywords": [
     "eclipse",
     "graphics",
@@ -29,16 +29,25 @@
       "url": "https://projects.eclipse.org/projects/ecd.glsp"
     }
   ],
-  "main": "lib/index",
-  "types": "lib/index",
+  "main": "lib/node/index",
+  "browser": {
+    "lib/node/index": "./lib/browser/index"
+  },
+  "types": "lib/common/index",
   "files": [
     "lib",
-    "src"
+    "src",
+    "node.js",
+    "node.d.ts",
+    "browser.js",
+    "browser.d.ts",
+    "common.js",
+    "common.d.ts"
   ],
   "scripts": {
     "build": "tsc -b",
     "clean": "rimraf lib *.tsbuildinfo coverage .nyc_output",
-    "generate:index": "glsp generateIndex src -f -s",
+    "generate:index": "glsp generateIndex src/browser src/common src/node -f -s",
     "lint": "eslint --ext .ts,.tsx ./src",
     "test": "mocha --config ../../.mocharc \"./src/**/*.spec.?(ts|tsx)\"",
     "test:ci": "yarn test --reporter mocha-ctrf-json-reporter",
@@ -46,12 +55,9 @@
     "watch": "tsc -w"
   },
   "dependencies": {
-    "@eclipse-glsp/server": "2.7.0-next.9+a58ea45",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "express": "^5.2.1"
-  },
-  "devDependencies": {
-    "@types/express": "^5.0.6"
+    "@eclipse-glsp/server": "2.8.0-next.0+bb0b4e8",
+    "@hono/node-server": "^1.19.9",
+    "@modelcontextprotocol/sdk": "^1.29.0"
   },
   "peerDependencies": {
     "inversify": "^6.1.3"
@@ -59,5 +65,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "a58ea45de80be3d2fcf46e0934af141b213f6187"
+  "gitHead": "bb0b4e86909b0c6ea8ba805a9aba68e4afd2decb"
 }

package/src/{resources → browser}/index.ts

@@ -14,7 +14,8 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
  ********************************************************************************/
 
-export * from './handlers/diagram-png-mcp-resource-handler';
-export * from './handlers/diagram-svg-mcp-resource-handler';
-export * from './services/element-types-provider';
-export * from './services/mcp-model-serializer';
+export * from './modules/browser-mcp-server-module';
+export * from './reexport';
+export * from './server/browser-mcp-request-context';
+export * from './server/mcp-worker-bridge';
+export * from './server/web-mcp-server-launcher';

package/src/browser/modules/browser-mcp-server-module.ts

@@ -0,0 +1,54 @@
+/********************************************************************************
+ * Copyright (c) 2026 EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+
+import { BindingTarget } from '@eclipse-glsp/server';
+import { AbstractMcpServerModule, DEFAULT_MCP_OPTIONS } from '../../common/modules/abstract-mcp-server-module';
+import { AbstractMcpServerLauncher } from '../../common/server/abstract-mcp-server-launcher';
+import { McpServerDefaults } from '../../common/server/mcp-options';
+import { McpRequestContext } from '../../common/server/mcp-request-context';
+import { BrowserMcpRequestContext } from '../server/browser-mcp-request-context';
+import { WebMcpServerLauncher } from '../server/web-mcp-server-launcher';
+
+/**
+ * Default {@link AbstractMcpServerModule} entry point for browser/web hosts (Bun, Deno, Cloudflare
+ * Worker, Service Worker, in-page Worker). Ships GLSP-default option values (see
+ * {@link BrowserMcpServerModule.DEFAULT_OPTIONS}) on top of the abstract module's hook defaults,
+ * and binds the web {@link WebMcpServerLauncher} + {@link BrowserMcpRequestContext}. Adopter-provided
+ * overrides via the constructor merge on top.
+ *
+ * Node-only deploy-side fields (`host`, `allowedHosts`, `allowedOrigins`, `acknowledgedNoAuth`)
+ * are intentionally omitted from defaults — adopters set these for their deployment, or run their
+ * own auth middleware around {@link AbstractMcpServerLauncher.getRequestHandler}.
+ *
+ * @experimental The MCP integration is under active development. Option names, schema shapes,
+ * and handler contracts MAY change in minor releases until the feature graduates from
+ * experimental status.
+ */
+export class BrowserMcpServerModule extends AbstractMcpServerModule {
+    static readonly DEFAULT_OPTIONS: McpServerDefaults = { ...DEFAULT_MCP_OPTIONS };
+
+    constructor(overrides: McpServerDefaults = {}) {
+        super({ ...BrowserMcpServerModule.DEFAULT_OPTIONS, ...overrides });
+    }
+
+    protected override bindMcpServerLauncher(): BindingTarget<AbstractMcpServerLauncher> {
+        return WebMcpServerLauncher;
+    }
+
+    protected override bindMcpRequestContext(): BindingTarget<McpRequestContext> {
+        return BrowserMcpRequestContext;
+    }
+}

package/src/browser/reexport.ts

@@ -0,0 +1,16 @@
+/********************************************************************************
+ * Copyright (c) 2026 EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+export * from '../common';

package/src/browser/server/browser-mcp-request-context.ts

@@ -0,0 +1,59 @@
+/********************************************************************************
+ * Copyright (c) 2026 EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+
+import { injectable } from 'inversify';
+import { McpRequestContext, McpRequestExtra } from '../../common/server/mcp-request-context';
+
+/**
+ * Browser-compatible {@link McpRequestContext} that holds one request context at a time.
+ * Hosts must serialise dispatches so they don't overwrite each other (e.g. via {@link McpWorkerBridge}).
+ */
+@injectable()
+export class BrowserMcpRequestContext implements McpRequestContext {
+    protected current: McpRequestExtra | undefined;
+    protected concurrencyWarned = false;
+
+    run<R>(extra: McpRequestExtra, callback: () => R): R {
+        // Warn once if an adopter forgot to serialise dispatches — silent context corruption would be hard to debug.
+        if (this.current !== undefined && !this.concurrencyWarned) {
+            this.concurrencyWarned = true;
+            console.warn(
+                'BrowserMcpRequestContext: concurrent run() detected — request contexts will overwrite each other. ' +
+                    'Serialise MCP dispatches (e.g. via McpWorkerBridge or an adopter-side queue around launcher.handleRequest).'
+            );
+        }
+        const prior = this.current;
+        this.current = extra;
+        let result: R;
+        try {
+            result = callback();
+        } catch (error) {
+            this.current = prior;
+            throw error;
+        }
+        if (result instanceof Promise) {
+            return result.finally(() => {
+                this.current = prior;
+            }) as unknown as R;
+        }
+        this.current = prior;
+        return result;
+    }
+
+    getStore(): McpRequestExtra | undefined {
+        return this.current;
+    }
+}

package/src/browser/server/mcp-worker-bridge.ts

@@ -0,0 +1,200 @@
+/********************************************************************************
+ * Copyright (c) 2026 EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+
+import { Disposable } from '@eclipse-glsp/server';
+import { AbstractMcpServerLauncher } from '../../common/server/abstract-mcp-server-launcher';
+import { McpServerDefaults } from '../../common/server/mcp-options';
+import { BrowserMcpServerModule } from '../modules/browser-mcp-server-module';
+
+export const MCP_REQUEST_MESSAGE_TYPE = 'mcp-request';
+export const MCP_RESPONSE_MESSAGE_TYPE = 'mcp-response';
+export const MCP_INIT_PORT_MESSAGE_TYPE = 'mcp-init-port';
+
+export interface McpRequestMessage {
+    type: typeof MCP_REQUEST_MESSAGE_TYPE;
+    id: string;
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+}
+
+export interface McpResponseMessage {
+    type: typeof MCP_RESPONSE_MESSAGE_TYPE;
+    id: string;
+    status: number;
+    statusText: string;
+    headers: Record<string, string>;
+    /** `ReadableStream` on Chromium (streams SSE); buffered `ArrayBuffer` on browsers without transferable streams. */
+    body: ReadableStream<Uint8Array> | ArrayBuffer | null;
+}
+
+/** Carries the SW↔Worker `MessagePort` transfer that wires MCP traffic over a dedicated channel. */
+export interface McpInitPortMessage {
+    type: typeof MCP_INIT_PORT_MESSAGE_TYPE;
+}
+
+export function isMcpRequestMessage(value: unknown): value is McpRequestMessage {
+    return Object(value) === value && (value as { type?: unknown }).type === MCP_REQUEST_MESSAGE_TYPE;
+}
+
+export function isMcpInitPortMessage(value: unknown): value is McpInitPortMessage {
+    return Object(value) === value && (value as { type?: unknown }).type === MCP_INIT_PORT_MESSAGE_TYPE;
+}
+
+/** Probes whether the current realm can transfer `ReadableStream` via `postMessage` (Chromium yes; Firefox / Safari no). */
+export function canTransferReadableStream(): boolean {
+    try {
+        const probe = new ReadableStream();
+        structuredClone(probe, { transfer: [probe] });
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+/** Minimal Worker scope contract — defined locally so the package compiles without the `webworker` lib. */
+export interface McpBridgeScope {
+    addEventListener(type: 'message', listener: (event: MessageEvent) => void): void;
+    removeEventListener(type: 'message', listener: (event: MessageEvent) => void): void;
+    postMessage(message: unknown, transfer?: Transferable[]): void;
+}
+
+/**
+ * Bridges `postMessage` traffic to an {@link AbstractMcpServerLauncher} for browser / Web Worker
+ * adopters that proxy MCP requests via Service-Worker → Web-Worker plumbing.
+ * See `ARCHITECTURE.md` (Portable handler) for the message protocol and queueing semantics.
+ */
+export class McpWorkerBridge implements Disposable {
+    protected resolveLauncher!: (launcher: AbstractMcpServerLauncher) => void;
+    protected readonly launcherReady: Promise<AbstractMcpServerLauncher>;
+    protected readonly listener = (event: MessageEvent): void => this.onMessage(event);
+    /** Serialise dispatches — `BrowserMcpRequestContext` is a single-slot store, not concurrency-safe. */
+    protected dispatchChain: Promise<void> = Promise.resolve();
+    protected readonly streamTransferable: boolean = canTransferReadableStream();
+    protected bufferingWarned = false;
+
+    constructor(protected readonly scope: McpBridgeScope = self as unknown as McpBridgeScope) {
+        this.launcherReady = new Promise<AbstractMcpServerLauncher>(resolve => {
+            this.resolveLauncher = resolve;
+        });
+        this.scope.addEventListener('message', this.listener);
+    }
+
+    dispose(): void {
+        this.scope.removeEventListener('message', this.listener);
+    }
+
+    /** Returns a {@link BrowserMcpServerModule} that registers its launcher with this bridge on DI activation. */
+    createServerModule(overrides?: McpServerDefaults): BrowserMcpServerModule {
+        const bridge = this;
+        class BridgedBrowserMcpServerModule extends BrowserMcpServerModule {
+            protected override onMcpServerLauncherActivated(launcher: AbstractMcpServerLauncher): void {
+                bridge.bindLauncher(launcher);
+            }
+        }
+        return new BridgedBrowserMcpServerModule(overrides);
+    }
+
+    /** First call binds; subsequent calls are no-ops. */
+    bindLauncher(launcher: AbstractMcpServerLauncher): void {
+        this.resolveLauncher(launcher);
+    }
+
+    protected onMessage(event: MessageEvent): void {
+        const data: unknown = event.data;
+        if (isMcpRequestMessage(data)) {
+            this.enqueueDispatch(data, event.ports[0]);
+            return;
+        }
+        if (isMcpInitPortMessage(data)) {
+            const port = event.ports[0];
+            if (!port) {
+                return;
+            }
+            port.onmessage = portEvent => {
+                const portData: unknown = portEvent.data;
+                if (isMcpRequestMessage(portData)) {
+                    this.enqueueDispatch(portData, port);
+                }
+            };
+            port.start();
+        }
+    }
+
+    protected enqueueDispatch(request: McpRequestMessage, port: MessagePort | undefined): void {
+        this.dispatchChain = this.dispatchChain
+            .then(() => this.dispatch(request, port))
+            .catch(err => console.error('MCP worker bridge failed:', err));
+    }
+
+    protected async dispatch(request: McpRequestMessage, port: MessagePort | undefined): Promise<void> {
+        try {
+            const launcher = await this.launcherReady;
+            const init: RequestInit = { method: request.method, headers: request.headers };
+            if (typeof request.body === 'string') {
+                init.body = request.body;
+            }
+            const response = await launcher.handleRequest(new Request(request.url, init));
+            const headers: Record<string, string> = {};
+            response.headers.forEach((value, key) => {
+                headers[key] = value;
+            });
+            this.reply(port, {
+                type: MCP_RESPONSE_MESSAGE_TYPE,
+                id: request.id,
+                status: response.status,
+                statusText: response.statusText,
+                headers,
+                body: await this.encodeBody(response)
+            });
+        } catch (err: unknown) {
+            const message = err instanceof Error ? err.message : String(err);
+            this.reply(port, {
+                type: MCP_RESPONSE_MESSAGE_TYPE,
+                id: request.id,
+                status: 500,
+                statusText: 'Internal Server Error',
+                headers: { 'content-type': 'text/plain' },
+                body: await this.encodeBody(new Response(`MCP worker bridge error: ${message}`))
+            });
+        }
+    }
+
+    /** Stream on Chromium; buffer to `ArrayBuffer` (still transferable) on browsers without transferable streams. */
+    protected async encodeBody(response: Response): Promise<ReadableStream<Uint8Array> | ArrayBuffer | null> {
+        if (this.streamTransferable) {
+            return response.body;
+        }
+        if (!this.bufferingWarned) {
+            this.bufferingWarned = true;
+            console.warn(
+                'McpWorkerBridge: ReadableStream is not transferable in this browser — buffering MCP response bodies. ' +
+                    'Chunked / SSE streaming will deliver as a single chunk; non-streaming MCP calls are unaffected.'
+            );
+        }
+        return response.arrayBuffer();
+    }
+
+    protected reply(port: MessagePort | undefined, message: McpResponseMessage): void {
+        const transfer: Transferable[] = message.body ? [message.body] : [];
+        if (port) {
+            port.postMessage(message, transfer);
+        } else {
+            this.scope.postMessage(message, transfer);
+        }
+    }
+}