How to Properly Retrieve HTTP Request Headers in a Spring AI MCP Server

In earlier articles the author used a custom WebMvcStreamableServerTransportProvider to intercept HTTP requests for authentication, which works but is invasive: each Spring AI upgrade may break it, the code is highly intrusive, requires deep framework knowledge, and is not officially recommended.

The Spring AI project now offers a standard, recommended, and elegant solution via the TransportContextExtractor extension point. By default McpTransportContext is empty ( McpTransportContext.EMPTY) to keep the MCP server transport‑agnostic. To obtain HTTP metadata such as headers, remote host, or query parameters, you must configure a TransportContextExtractor on your transport provider.

By default, the `McpTransportContext` is empty (`McpTransportContext.EMPTY`). This is by design, to keep the MCP server transport-agnostic. If you need transport-specific metadata (for example, HTTP headers, remote host, etc) in your tools, configure a `TransportContextExtractor` on your transport provider.

The author adds a configuration class (using Spring AI 1.1.2) that injects a McpTransportContextExtractor and, in its callback, captures the original ServerRequest and stores it in the McpTransportContext. This makes the raw request object available to tool methods.

Inside a tool method, the steps are:

Obtain the McpTransportContext.

Read the stored ServerRequest from the context.

Access request data such as request.headers(), request.path(), request.uri(), request.queryParams(), and cookies.

The article demonstrates the workflow with an AI client that sends custom HTTP headers. Debugging in IDEA shows the extracted request headers, URL, and query parameters, as illustrated by the following screenshots:

Further screenshots show the retrieved request headers, URL, and query parameters after the tool method runs.

A comparison image highlights the advantages of the new method over the previous custom provider approach: the new method uses a standard extension point, is officially supported, has updated documentation, and is safe for upgrades.

In summary, the MCP server is transport‑agnostic, but Spring AI provides the TransportContextExtractor extension point to inject the original HTTP request into the context. After configuring this, developers can implement real authentication, multi‑tenant isolation, gateway data passing, channel statistics, IP‑based risk control, and other enterprise scenarios directly within MCP tools.