Struct StreamableHttpServerConfig 

#[non_exhaustive]
pub struct StreamableHttpServerConfig {
    pub sse_keep_alive: Option<Duration>,
    pub sse_retry: Option<Duration>,
    pub legacy_session_mode: bool,
    pub json_response: bool,
    pub cancellation_token: CancellationToken,
    pub allowed_hosts: Vec<String>,
    pub allowed_origins: Vec<String>,
    pub session_store: Option<Arc<dyn SessionStore>>,
    pub max_request_body_bytes: usize,
    pub stateless_protocol_metadata_required: bool,
}

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

sse_keep_alive: Option<Duration>

The ping message duration for SSE connections.

sse_retry: Option<Duration>

The retry interval for SSE priming events.

legacy_session_mode: bool

If true, the server will create a session for each request and keep it alive. When enabled, SSE priming events are sent to enable client reconnection.

Only applies to legacy protocol versions (< 2026-07-28). Per SEP-2567, sessions are removed from the 2026-07-28 version, so requests negotiating that version are always served statelessly regardless of this setting.

json_response: bool

When true and legacy_session_mode is false, the server prefers Content-Type: application/json for simple request-response tools. If the handler emits a notification or request before the final response, the server falls back to text/event-stream so no message is lost.

cancellation_token: CancellationToken

Cancellation token for the Streamable HTTP server.

When this token is cancelled, all active sessions are terminated and the server stops accepting new requests.

allowed_hosts: Vec<String>

Allowed hostnames or host:port authorities for inbound Host validation.

By default, Streamable HTTP servers only accept loopback hosts to prevent DNS rebinding attacks against locally running servers. Public deployments should override this list with their own hostnames. examples: allowed_hosts = [“localhost”, “127.0.0.1”, “0.0.0.0”] or with ports: allowed_hosts = [“example.com”, “example.com:8080”]

allowed_origins: Vec<String>

Allowed browser origins for inbound Origin validation.

Defaults to an empty list, which disables Origin validation. When non-empty, requests carrying an Origin header must match per RFC 6454 (scheme, host, port); missing-Origin requests still pass. Entries must include a scheme; "null" matches the browser’s Origin: null. examples: allowed_origins = [“https://app.example.com”, “http://localhost:8080”]

session_store: Option<Arc<dyn SessionStore>>

Optional external session store for cross-instance recovery.

When set, SessionState (the client’s initialize parameters) is persisted after a successful handshake and deleted when the session closes. On any subsequent request that arrives at an instance with no in-memory session, the store is consulted: if an entry is found the session is transparently restored so the client does not need to re-initialize.

Example

use std::sync::Arc;
use rmcp::transport::streamable_http_server::{
    StreamableHttpServerConfig, session::SessionStore,
};

let config = StreamableHttpServerConfig {
    session_store: Some(Arc::new(MyRedisStore::new())),
    ..Default::default()
};

max_request_body_bytes: usize

Maximum POST request body size in bytes.

Enforced while streaming the body, independent of Content-Length, chunked transfer encoding, or HTTP version. Oversized payloads receive a 413 Payload Too Large response.

stateless_protocol_metadata_required: bool

Require stateless JSON-RPC request POSTs to carry per-request protocol signals before handler dispatch.

Non-initialize requests must carry MCP-Protocol-Version; ordinary non-discovery requests must also carry _meta.io.modelcontextprotocol/protocolVersion. server/discover retains its existing request-metadata validation. For 2026-07-28 requests, the server handler continues to require the remaining per-request metadata, including clientCapabilities. Initialize, notifications, and other message kinds retain their existing rules.

This option applies to requests routed statelessly. Set legacy_session_mode to false to ensure every request uses that path. Legacy session routing and its error precedence remain unchanged.

The validator checks metadata presence rather than applying a version allowlist. However, rmcp clients negotiated below 2026-07-28 do not attach per-request protocol metadata, so enabling this option rejects their ordinary requests. Servers using this option should normally override ServerHandler::supported_protocol_versions to advertise only 2026-07-28 and later.

Default is false, preserving today’s legacy behavior where an absent header is treated as protocol version 2025-03-26.

Implementations

impl StreamableHttpServerConfig

pub fn with_allowed_hosts( self, allowed_hosts: impl IntoIterator<Item = impl Into<String>>, ) -> StreamableHttpServerConfig

pub fn disable_allowed_hosts(self) -> StreamableHttpServerConfig

Disable allowed hosts. This will allow requests with any Host header, which is NOT recommended for public deployments.

pub fn with_allowed_origins( self, allowed_origins: impl IntoIterator<Item = impl Into<String>>, ) -> StreamableHttpServerConfig

pub fn disable_allowed_origins(self) -> StreamableHttpServerConfig

Disable Origin validation, reverting to the default ignore-Origin behavior.

pub fn with_sse_keep_alive( self, duration: Option<Duration>, ) -> StreamableHttpServerConfig

pub fn with_sse_retry( self, duration: Option<Duration>, ) -> StreamableHttpServerConfig

pub fn with_legacy_session_mode( self, legacy_session_mode: bool, ) -> StreamableHttpServerConfig

pub fn with_json_response( self, json_response: bool, ) -> StreamableHttpServerConfig

pub fn with_cancellation_token( self, token: CancellationToken, ) -> StreamableHttpServerConfig

pub fn with_max_request_body_bytes( self, bytes: usize, ) -> StreamableHttpServerConfig

Set the maximum POST request body size in bytes.

pub fn with_stateless_protocol_metadata_required( self, stateless_protocol_metadata_required: bool, ) -> StreamableHttpServerConfig

Require per-request protocol signals on stateless JSON-RPC request POSTs.

See StreamableHttpServerConfig::stateless_protocol_metadata_required.

Trait Implementations

impl Clone for StreamableHttpServerConfig

fn clone(&self) -> StreamableHttpServerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for StreamableHttpServerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for StreamableHttpServerConfig

fn default() -> StreamableHttpServerConfig

Returns the “default value” for a type.