MCP 原理及 Java 开发指南

@Service
public class InvoiceService {

    @Tool(description = "获取发票链接")
    public String getInvoiceUrl(@ToolParam(required = true, description = "发票 id") String invoiceId) {
        return "https://www.example.com/invoice/" + invoiceId;
    }
}

package com.example.mcp;

import org.springframework.ai.mcp.server.tool.ToolCallbackProvider;
import org.springframework.ai.mcp.server.tool.MethodToolCallbackProvider;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.web.reactive.function.client.WebClient;

@SpringBootApplication
public class McpServerApplication {
    
    public static void main(String[] args) {
        SpringApplication.run(McpServerApplication.class, args);
    }
    
    /**
     * 注册所有 Tools
     */
    @Bean
    public ToolCallbackProvider toolCallbackProvider(
            DatabaseTools databaseTools,
            FileTools fileTools,
            HttpTools httpTools
    ) {
        return MethodToolCallbackProvider.builder()
            .toolObjects(databaseTools, fileTools, httpTools)
            .build();
    }
    
    /**
     * WebClient for HTTP tools
     */
    @Bean
    public WebClient webClient() {
        return WebClient.builder()
            .defaultHeader("User-Agent", "MCP-Server/1.0")
            .build();
    }
}

public class SecurityValidator {
    
    public static void validateSqlQuery(String sql) {
        // 防止 SQL 注入
        String lowerSql = sql.toLowerCase();
        String[] dangerousKeywords = {
            "drop", "delete", "update", "insert", 
            "truncate", "alter", "create"
        };
        
        for (String keyword : dangerousKeywords) {
            if (lowerSql.contains(keyword)) {
                throw new SecurityException(
                    "不允许的 SQL 操作: " + keyword
                );
            }
        }
    }
    
    public static Path validatePath(Path basePath, String userPath) {
        Path resolved = basePath.resolve(userPath).normalize();
        
        // 防止路径遍历攻击
        if (!resolved.startsWith(basePath)) {
            throw new SecurityException(
                "路径超出允许范围: " + userPath
            );
        }
        
        return resolved;
    }
}

@Configuration
public class McpSecurityConfig {
    
    @Bean
    public McpAuthorizationManager authorizationManager() {
        return new McpAuthorizationManager() {
            @Override
            public boolean canExecuteTool(String toolName, Principal user) {
                // 基于用户角色的权限控制
                return switch (toolName) {
                    case "query_database" -> 
                        user.hasRole("DATA_ANALYST");
                    case "write_file" -> 
                        user.hasRole("DEVELOPER");
                    default -> true;
                };
            }
        };
    }
}

@Aspect
@Component
public class RateLimitAspect {
    
    private final RateLimiter rateLimiter = 
        RateLimiter.create(10.0); // 每秒 10 个请求
    
    @Around("@annotation(Tool)")
    public Object rateLimit(ProceedingJoinPoint joinPoint) 
            throws Throwable {
        if (!rateLimiter.tryAcquire()) {
            throw new RateLimitException(
                "请求过于频繁,请稍后再试"
            );
        }
        return joinPoint.proceed();
    }
}

@Service
public class CachedDatabaseTools {
    
    @Cacheable(value = "tableSchema", key = "#tableName")
    public TableSchema getTableSchema(String tableName) {
        // 缓存表结构,避免重复查询
        return databaseService.getSchema(tableName);
    }
    
    @Cacheable(
        value = "queryResults",
        key = "#sql",
        condition = "#sql.toLowerCase().startsWith('select')"
    )
    public QueryResult executeQuery(String sql) {
        return databaseService.execute(sql);
    }
}

@Service
public class AsyncFileTools {
    
    @Tool(description = "异步搜索文件")
    public CompletableFuture<List<String>> searchFilesAsync(
            @ToolParam(name = "pattern") String pattern
    ) {
        return CompletableFuture.supplyAsync(() -> {
            // 耗时的文件搜索操作
            return fileService.search(pattern);
        });
    }
}

@Configuration
public class DatabaseConfig {
    
    @Bean
    public DataSource dataSource() {
        HikariConfig config = new HikariConfig();
        config.setJdbcUrl(jdbcUrl);
        config.setUsername(username);
        config.setPassword(password);
        
        // 优化连接池配置
        config.setMaximumPoolSize(20);
        config.setMinimumIdle(5);
        config.setConnectionTimeout(30000);
        config.setIdleTimeout(600000);
        
        return new HikariDataSource(config);
    }
}

@ControllerAdvice
public class McpExceptionHandler {
    
    @ExceptionHandler(SecurityException.class)
    public ResponseEntity<ErrorResponse> handleSecurityException(
            SecurityException ex
    ) {
        return ResponseEntity
            .status(HttpStatus.FORBIDDEN)
            .body(new ErrorResponse(
                "SECURITY_ERROR",
                ex.getMessage()
            ));
    }
    
    @ExceptionHandler(IllegalArgumentException.class)
    public ResponseEntity<ErrorResponse> handleValidationException(
            IllegalArgumentException ex
    ) {
        return ResponseEntity
            .status(HttpStatus.BAD_REQUEST)
            .body(new ErrorResponse(
                "VALIDATION_ERROR",
                ex.getMessage()
            ));
    }
    
    @ExceptionHandler(Exception.class)
    public ResponseEntity<ErrorResponse> handleGenericException(
            Exception ex
    ) {
        log.error("Unexpected error", ex);
        return ResponseEntity
            .status(HttpStatus.INTERNAL_SERVER_ERROR)
            .body(new ErrorResponse(
                "INTERNAL_ERROR",
                "服务暂时不可用,请稍后重试"
            ));
    }
}

record ErrorResponse(
    String code,
    String message
) {}

@Aspect
@Component
public class McpMonitoringAspect {
    
    @Around("@annotation(tool)")
    public Object monitorToolExecution(
            ProceedingJoinPoint joinPoint,
            Tool tool
    ) throws Throwable {
        String toolName = tool.name();
        long startTime = System.currentTimeMillis();
        
        try {
            Object result = joinPoint.proceed();
            long duration = System.currentTimeMillis() - startTime;
            
            // 记录成功的工具调用
            log.info(
                "Tool executed: {} | Duration: {}ms",
                toolName, duration
            );
            
            // 发送指标到监控系统
            metricsService.recordToolExecution(
                toolName, duration, "success"
            );
            
            return result;
            
        } catch (Exception ex) {
            long duration = System.currentTimeMillis() - startTime;
            
            // 记录失败的工具调用
            log.error(
                "Tool failed: {} | Duration: {}ms | Error: {}",
                toolName, duration, ex.getMessage()
            );
            
            metricsService.recordToolExecution(
                toolName, duration, "failure"
            );
            
            throw ex;
        }
    }
}

@Service
public class IdeTools {
    
    @Tool(description = "生成单元测试")
    public String generateUnitTest(
            @ToolParam(name = "source_code") String sourceCode,
            @ToolParam(name = "test_framework") String framework
    ) {
        // 分析源代码
        CodeAnalysis analysis = codeAnalyzer.analyze(sourceCode);
        
        // 生成测试代码
        return testGenerator.generate(analysis, framework);
    }
    
    @Tool(description = "代码重构建议")
    public List<RefactoringSuggestion> suggestRefactoring(
            @ToolParam(name = "code") String code
    ) {
        return refactoringService.analyzePotentialImprovements(code);
    }
}

@Service
public class DataAnalyticsTools {
    
    @Tool(description = "自然语言查询")
    public QueryResult nlQuery(
            @ToolParam(name = "question") String question
    ) {
        // 将自然语言转换为 SQL
        String sql = nlToSqlConverter.convert(question);
        
        log.info("Generated SQL: {}", sql);
        
        // 执行查询
        return databaseService.executeQuery(sql);
    }
    
    @Tool(description = "生成数据可视化")
    public ChartConfig generateChart(
            @ToolParam(name = "data") List<Map<String, Object>> data,
            @ToolParam(name = "chart_type") String chartType
    ) {
        return chartGenerator.generate(data, chartType);
    }
}

@Service
public class DocumentationTools {
    
    @Tool(description = "生成 API 文档")
    public String generateApiDocs(
            @ToolParam(name = "swagger_spec") String swaggerSpec
    ) {
        return apiDocGenerator.generate(swaggerSpec);
    }
    
    @Tool(description = "更新用户手册")
    public UpdateResult updateUserManual(
            @ToolParam(name = "section") String section,
            @ToolParam(name = "content") String content
    ) {
        Path manualPath = docsPath.resolve("user-manual.md");
        return documentService.updateSection(manualPath, section, content);
    }
}

@Service
public class DevOpsTools {
    
    @Tool(description = "部署应用")
    public DeploymentResult deploy(
            @ToolParam(name = "environment") String environment,
            @ToolParam(name = "version") String version
    ) {
        return deploymentService.deploy(environment, version);
    }
    
    @Tool(description = "查看日志")
    public List<LogEntry> getLogs(
            @ToolParam(name = "service") String service,
            @ToolParam(name = "lines") int lines
    ) {
        return logService.getTailLogs(service, lines);
    }
    
    @Tool(description = "检查服务健康状态")
    public HealthStatus checkHealth(
            @ToolParam(name = "service") String service
    ) {
        return healthCheckService.check(service);
    }
}

@Tool(description = "异步任务")
public TaskId startAsyncTask(
        @ToolParam(name = "input") String input
) {
    // 返回任务 ID
    return taskService.submit(input);
}

@Tool(description = "查询任务状态")
public TaskStatus getTaskStatus(
        @ToolParam(name = "task_id") String taskId
) {
    return taskService.getStatus(taskId);
}