one toolcall request so many middware Added???

[followheart26]

			var withValidate = func(h mcp.MethodHandler[*mcp.ServerSession]) mcp.MethodHandler[*mcp.ServerSession] {
				return func(ctx context.Context, s *mcp.ServerSession, method string, params mcp.Params) (result mcp.Result, err error) {
					if method != "tools/call" {
						return h(ctx, s, method, params)
					}
					token := request.Header.Get(AuthorizationHeader)
					golib.Log("info", "token:%s added to ctx, seesionId: %s", token, s.ID())
					ctx = context.WithValue(ctx, "token", token)
					return h(ctx, s, method, params)
				}
			}
			o.svr.AddReceivingMiddleware(withValidate)
			return o.svr
		}, nil)

when several requests from different process with dfferent token sent to the server , finally if i send a toolcall request, the middleware log happened 12 times, and the token has been covered many times?
is this a bug?
Or may be i can't do something like this.

[followheart26]

2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer sadasdsadsadsa added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer sadasdsadsadsa added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer sadasdsadsadsa added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer sadasdsadsadsa added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer sadasdsadsadsa added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer sadasdsadsadsa added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer asdjaslkdjlajds added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer asdjaslkdjlajds added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer asdjaslkdjlajds added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer sadasdasd added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer e1f9ea5537678b09 added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][info]: token:Bearer e1f9ea5537678b09 added to ctx, seesionId: OOMK35O3JDUZPGEDNGJCHVEUEV
2025-07-25 15:26:45 [PID=23706][GOID=1626][LogId=nob-aidbkyhtb7bbgr][info]: rootToolHandler, token: Bearer e1f9ea5537678b09, session id OOMK35O3JDUZPGEDNGJCHVEUEV

[loki-mine]

@followheart26 Can you please share how did you get the request object. I am trying to do something similar and would help if you can share on how your middle ware got the request object. My use case is , I want to extract header at every tool invocation.

[followheart26]

i

@followheart26 Can you please share how did you get the request object. I am trying to do something similar and would help if you can share on how your middle ware got the request object. My use case is , I want to extract header at every tool invocation.

I do this in the httphandler definition, but it's wrong because it will excute whenever a session was created,so the midware will be added many times. but the middleware definition has no request object in its function params, how can i get the httpheader? i have the same question with you.

[jba]

@followheart26 The problem here is that the middleware you're using is at too high a level. It doesn't know about HTTP, because it has to support all MCP transports, not just the ones over HTTP. (By the way, in your example in the top post, where does the variable request come from?)

I don't think we have a good way to do this yet. See this comment. We would welcome suggestions for how best to provide what you want.

[followheart26]

@jba Why not allow users to bind some Custom variable to the session object, like java domain object.

[followheart26]

@jba in our project, we want to Perceive user information to let the mcp tool perform different effects and results

[loki-mine]

@jba For my requirement, the clients will have a Oauth2 token which can be sent over the header I assume( I do not have entire details of the client) but how can I access such header or information on the server side while the tools are invoked.

[jba]

@loki-mine We can provide something like this AuthInfo type in the TypeScript SDK.

@followheart26 What if we added something like this to our ServerOptions:

VerifyToken func(accessToken string) (*AuthInfo, error)

Then you could provide a function that verifies and parses an access token. Would that do what you want?

[followheart26]

@jba maybe not only verifytoken, what if offer a serveroption like customVariable func(xx)(xx)

[followheart26]

@jba After i read some source code ,i think maybe we can has a good way to do this, below is my temporary method
i add a requesthandler to the StreamableHTTPHandler

type StreamableHTTPHandler struct {
	getServer func(*http.Request) *Server
	RequestHandler func(*http.Request, *StreamableServerTransport)

	sessionsMu sync.Mutex
	sessions   map[string]*StreamableServerTransport // keyed by IDs (from Mcp-Session-Id header)
}

than, when i create it , i pass the func param

handler = mcp.NewStreamableHTTPHandler(func(request *http.Request) *mcp.Server {
			return o.svr
		}, nil, func(request *http.Request, transport *mcp.StreamableServerTransport) {
			token := request.Header.Get(AuthorizationHeader)
			SessionData[transport.SessionID()]["token"] = token
		})

SessionData is a gloabal map to build seesionId -> DataMap
DataMap is a map[string]string to let user bind some custom variables
In this way, ican store something like token userinfo reqID expireTime ......or anything else

At last, i excute the requestHandler in the serveHttp function

if session == nil {
		s := NewStreamableServerTransport(randText(), nil)
		server := h.getServer(req)
		h.RequestHandler(req,s) // here
		if server == nil {
			// The getServer argument to NewStreamableHTTPHandler returned nil.
			http.Error(w, "no server available", http.StatusBadRequest)
			return
		}
		// Pass req.Context() here, to allow middleware to add context values.
		// The context is detached in the jsonrpc2 library when handling the
		// long-running stream.
		if _, err := server.Connect(req.Context(), s); err != nil {
			http.Error(w, "failed connection", http.StatusInternalServerError)
			return
		}
		h.sessionsMu.Lock()
		h.sessions[s.id] = s
		h.sessionsMu.Unlock()
		session = s
	}

this solution is very simple and temporary, maybe the serverOption can do something like this
i hope my solution can give you some help and add this feature in the next version
we really hope to use this feature as soon as possible

[followheart26]

Or We can bind data directly to the serversession object

[followheart26]

Also， the server's variable tools is private, i hope expose it so i can intercept the toollist request and then return the subset of the tools

[jba]

I was thinking that the AuthInfo returned by the VerifyToken function that I mentioned above would be stored in the session, where you could get it.

But that would only let you get things from the Authorization header value. Are there other headers that might be of interest to someone?