使用 Quarkus MCP 客户端从命令行访问安全的 MCP HTTP 服务器

<dependency>
    <groupId>io.quarkiverse.mcp</groupId>
    <artifactId>quarkus-mcp-server-sse</artifactId> (1)
    <version>1.4.0</version>
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-oidc</artifactId> (2)
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-rest</artifactId> (3)
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-rest-client-oidc-token-propagation</artifactId> (4)
</dependency>

package io.quarkiverse.langchain4j.sample;

import org.eclipse.microprofile.rest.client.inject.RestClient;
import io.quarkiverse.mcp.server.TextContent;
import io.quarkiverse.mcp.server.Tool;
import jakarta.inject.Inject;

public class ServiceAccountNameProvider { (1)

    @RestClient
    @Inject
    ServiceAccountNameRestClient serviceAccountNameRestClient; (2)

    @Tool(name = "sevice-account-name-provider", description = "Provides a name of the current service account") (1)
    TextContent provideServiceAccountName() {
        return new TextContent(serviceAccountNameRestClient.getServiceAccountName()); (2)
    }
}

package io.quarkiverse.langchain4j.sample;

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.token.propagation.common.AccessToken;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Produces;

@RegisterRestClient
@AccessToken (2)
public interface ServiceAccountNameRestClient {

    @GET
    @Produces("text/plain")
    String getServiceAccountName(); (1)
}

package io.quarkiverse.langchain4j.sample;

import io.quarkus.security.Authenticated;
import io.quarkus.security.identity.SecurityIdentity;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.Produces;

@Path("/service-account-name")
public class ServiceAccountNameRestServer {

    @Inject
    SecurityIdentity securityIdentity;

    @GET
    @Produces("text/plain")
    @Authenticated (1)
    public String getServiceAccountName() {
        return securityIdentity.getPrincipal().getName(); (2)
    }
}

# MCP server
quarkus.mcp.server.server-info.name=Service Account Name Provider (1)
quarkus.mcp.server.traffic-logging.enabled=true
quarkus.mcp.server.traffic-logging.text-limit=1000

# Require an authenticated access to MCP server
quarkus.http.auth.permission.authenticated.paths=/mcp/* (2)
quarkus.http.auth.permission.authenticated.policy=authenticated

# Default Quarkus OIDC tenant that verifies access tokens which reach the MCP server.
quarkus.oidc.client-id=quarkus-mcp-server (3)
quarkus.oidc.token.audience=quarkus-mcp-server (4)

# Request a token exchange before the token propagation
quarkus.rest-client-oidc-token-propagation.exchange-token=true (4)

# OIDC client that performs the current token exchange
quarkus.oidc-client.auth-server-url=${quarkus.oidc.auth-server-url} (5)
quarkus.oidc-client.client-id=${quarkus.oidc.client-id}
quarkus.oidc-client.credentials.secret=${quarkus.oidc.credentials.secret}
quarkus.oidc-client.scopes=quarkus-mcp-service-scope
quarkus.oidc-client.grant.type=exchange
quarkus.oidc-client.grant-options.exchange.subject_token_type=urn:ietf:params:oauth:token-type:access_token (6)

# REST client which accesses a protected REST server, by propagating the exchanged token
io.quarkiverse.langchain4j.sample.ServiceAccountNameRestClient/mp-rest/url=https://:8080/service-account-name  (7)

# OIDC `service-account-name-rest-server` tenant that secures a protected REST server.
quarkus.oidc.service-account-name-rest-server.auth-server-url=${quarkus.oidc.auth-server-url} (8)
quarkus.oidc.service-account-name-rest-server.token.audience=quarkus-mcp-service (9)
quarkus.oidc.service-account-name-rest-server.tenant-paths=/service-account-name

# Keycloak devservice that enables a default OIDC tenant that secures MCP server.
quarkus.keycloak.devservices.image-name=quay.io/keycloak/keycloak:26.3.1 (10)
quarkus.keycloak.devservices.port=8081
# Keycloak may require more memory on some systems
quarkus.keycloak.devservices.container-memory-limit=1250M

mvn quarkus:dev

<dependency>
    <groupId>io.quarkiverse.langchain4j</groupId>
    <artifactId>quarkus-langchain4j-ai-gemini</artifactId> (1)
</dependency>
<dependency>
    <groupId>io.quarkiverse.langchain4j</groupId>
    <artifactId>quarkus-langchain4j-mcp</artifactId> (2)
</dependency>
<dependency>
    <groupId>io.quarkiverse.langchain4j</groupId>
    <artifactId>quarkus-langchain4j-oidc-client-mcp-auth-provider</artifactId> (3)
</dependency>
<dependency>
   <groupId>io.quarkus</groupId>
   <artifactId>quarkus-picocli</artifactId> (4)
</dependency>

package io.quarkiverse.langchain4j.sample;

import dev.langchain4j.service.UserMessage;
import io.quarkiverse.langchain4j.RegisterAiService;
import io.quarkiverse.langchain4j.mcp.runtime.McpToolBox;

@RegisterAiService
public interface PoemService {
    @UserMessage("""
            Write a short 1 paragraph poem in {language} about a Java programming language.
            Provide a translation to English if the original poem language is not English.
            Dedicate the poem to the service account, refer to this account by its name.""") (1)
    @McpToolBox("service-account-name") (2)
    String writePoem(String language); (1)
}

package io.quarkiverse.langchain4j.sample;

import java.util.concurrent.Callable;
import jakarta.enterprise.context.control.ActivateRequestContext;
import jakarta.inject.Inject;
import picocli.CommandLine.Command;
import picocli.CommandLine.Option;

@Command(name = "poem", mixinStandardHelpOptions = true, description = "Create a poem", version = "v1.0")
@ActivateRequestContext
public class PoemCommand implements Callable<Integer> {

    @Option(names = { "-l", "--language" }, description = "Poem language", defaultValue = "English")
    String poemLanguage;

    @Inject
    PoemService poemService;

    @Override
    public Integer call() {
        System.out.println(poemService.writePoem(poemLanguage)); (1)
        return 0;
    }
}

quarkus.langchain4j.mcp.service-account-name.transport-type=http (1)
quarkus.langchain4j.mcp.service-account-name.url=https://:8081/mcp/sse/ (2)

quarkus.oidc-client.auth-server-url=https://:8081/realms/quarkus (3)
quarkus.oidc-client.client-id=quarkus-mcp-client (4)
quarkus.oidc-client.credentials.secret=${oidc_client_secret} (5)
quarkus.oidc-client.scopes=quarkus-mcp-server-scope (6)

quarkus.langchain4j.ai.gemini.api-key=${ai_gemini_api_key} (7)
quarkus.langchain4j.ai.gemini.log-requests=true (8)
quarkus.langchain4j.ai.gemini.log-responses=true

mvn clean package

java -jar target/quarkus-app/quarkus-run.jar

For service-account-quarkus-mcp-client, this Java ode I write,
A language strong, with classes bright, and objects shining light.
From simple apps to systems grand, its power knows no end,
With threads and streams, a helping hand,  a journey without bend.
Its virtual machine, a sturdy friend,  on which great feats depend.

java -jar target/quarkus-app/quarkus-run.jar --language Greek

Here's a short poem in Greek about Java, dedicated to the service account "service-account-quarkus-mcp-client":

**Greek:**

Ω, Java, γλώσσα ισχυρή και γρήγορη,
για προγραμματισμό, εργαλείο ακριβές.
Στον service-account-quarkus-mcp-client αφιερωμένη,
η δύναμή σου, πάντα  αξιοθαύμαστη.

**English Translation:**

O Java, language strong and fast,
For programming, a precise tool.
Dedicated to service-account-quarkus-mcp-client,
Your power, always admirable.