feat(api): native MCP (Model Context Protocol) server

Merged
RO
2mo ago
+2401-9

Proposed changes

Adds a native Model Context Protocol server that lets MCP-capable clients use a bounded set of Rocket.Chat REST operations over JSON-RPC 2.0 and Streamable HTTP.

The implementation is enterprise code under apps/meteor/ee/server/api/mcp and intentionally reuses Rocket.Chat's existing REST route metadata, authentication, permission checks, validation, rate limiting, and audit behavior. It adds no runtime dependency and does not expose the full REST API.

How it works

  • Registers POST /api/v1/mcp as an authenticated API route. GET returns 405 Allow: POST because this stateless implementation does not expose an SSE stream.
  • Supports initialize, ping, tools/list, tools/call, and JSON-RPC notifications and batches.
  • Derives MCP tool names, descriptions, and input schemas from typed REST route metadata.
  • Exposes a small curated catalog by default and an explicitly allow-listed extended catalog when enabled.
  • Dispatches tool calls through the existing REST layer as the authenticated user, preserving endpoint validation and authorization.
  • Validates browser Origin values against the workspace origin or explicitly configured CORS origins to protect the local HTTP transport from DNS rebinding. Native clients without an Origin header remain supported.
  • Validates supported MCP-Protocol-Version values while retaining compatibility with clients that omit the header.
  • Applies a 20-second dispatch timeout, 5 MiB REST-body and final-response limits, bounded batches, redirect rejection, path-prefix support, and the existing REST rate limits.

Access control

The endpoint requires all of the following:

  1. Personal Access Token authentication using X-User-Id and X-Auth-Token; regular session tokens are rejected.
  2. The Rocket.Chat AI add-on license module (chat.rocket.rc-ai).
  3. The access-mcp permission, granted to admin by default.
  4. The MCP_Enabled setting, which is off by default.

Administration

MCP is configured from Administration → AI Center → MCP.

  • Enable MCP endpoint enables /api/v1/mcp.
  • Expose extended MCP toolset switches from the curated catalog to the bounded extended allow list. Its warning explains that the additional tools can modify workspace data.

The feature is labeled alpha and remains disabled by default. Its capabilities and configuration may evolve as feedback is collected.

Testing

  • 37 focused unit tests cover route registration and gates, transport security, JSON-RPC behavior, notifications and bounded-concurrency batches, catalog generation, schema normalization, dispatch failures, per-tool and aggregate response limits, and catalog selection. The shared CORS middleware's six tests cover the negotiated protocol header in browser preflight responses.
  • Focused MCP tests pass with 94.09% statement coverage and 100% function coverage.
  • Targeted ESLint, localization lint, Meteor typecheck, and REST typings typecheck/lint pass.
  • Live local protocol checks cover initialization, catalog discovery, tool calls, unsupported protocol versions, hostile origins, GET behavior, and bodyless notifications.
  • The extended catalog was audited against disposable local fixtures: all 68 write tools were exercised and cleaned up, and read-tool behavior was verified, including expected setting-dependent failures.

Documentation

See docs/features/mcp-server.md for client configuration, security behavior, tool catalogs, protocol details, and troubleshooting.

Manual smoke test

curl -s http://localhost:3000/api/v1/mcp \
  -H 'Content-Type: application/json' \
  -H 'X-User-Id: <user-id>' \
  -H 'X-Auth-Token: <personal-access-token>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"smoke-test","version":"1.0.0"}}}'

Summary by CodeRabbit

  • New Features
    • Added an alpha, disabled-by-default MCP server endpoint for AI tool discovery and execution.
    • Added AI Center controls for enabling MCP and exposing extended tools.
    • Added permission and personal access token authentication support.
    • Added origin, protocol, request-size, timeout, and response validation safeguards.
  • Documentation
    • Added MCP configuration, usage, authentication, limitations, and client connection guidance.
  • Bug Fixes
    • Updated CORS handling to advertise MCP protocol support only when enabled.

AI-56