Crate atd_server_http 

Streamable-HTTP transport for ATD — sibling of atd-server.

This crate implements the SP-streamable-http design (docs/superpowers/specs/2026-05-11-sp-streamable-http-design.md): a one-endpoint MCP JSON-RPC 2.0 listener that delegates every tools/call to the same atd-runtime::dispatch::run_tool the Unix-socket transport uses. Browser PWAs, Cursor, Claude.ai, OpenAI Functions over HTTP — anything that speaks MCP Streamable HTTP — can reach an ATD-registered tool through this transport without any bespoke ATD wire knowledge.

Composition (SP-streamable-http §4.5):

let registry: atd_runtime::Registry = my_tools();
let cfg = atd_server_http::HttpServerConfig::default();
let (router, server) = atd_server_http::Server::builder(registry)
    .config(cfg)
    .build();
// Adopters may extend the router with their own routes here.
server.serve(router).await?;

What is not in this crate (deferred to future SPs — SP §9):

• SSE for tools/call (single response per request — adopter routes layer SSE on top of the returned Router).
• Mcp-Session-Id sessions / resumability / Last-Event-ID.
• TLS termination (operators front with nginx / Caddy / Tauri).
• OAuth 2.1 token issuance (bearer validated, not minted).

Re-exports

pub use config::HttpServerConfig;

pub use error::HttpServerError;

pub use server::Server;

pub use server::ServerBuilder;

pub use sse_refresh::AuthLostReason;

pub use sse_refresh::DEFAULT_REFRESH_CADENCE;

pub use sse_refresh::RefreshEvent;

pub use sse_refresh::spawn_bearer_refresh;

Modules

bearer

Bearer-token parsing + broker handoff.

config

HttpServerConfig — HTTP-listener-specific configuration.

error

HTTP-listener errors.

mcp

MCP JSON-RPC 2.0 ↔ ATD translation.

origin

Origin allow-list — fail-closed default per MCP Security Warning.

server

Server — the HTTP listener and accept loop.

sse_refresh

SP-token-broker-phase2 §4.7 — SSE long-connection bearer refresh.