Use Quarkus MCP client to access secure MCP HTTP servers

<dependency>
    <groupId>io.quarkiverse.mcp</groupId>
    <artifactId>quarkus-mcp-server-sse</artifactId> (1)
    <version>1.1.1</version>
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-oidc</artifactId> (2)
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-hibernate-orm-panache</artifactId> (3)
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-jdbc-postgresql</artifactId> (3)
</dependency>

package io.quarkiverse.langchain4j.sample;

import io.quarkiverse.mcp.server.TextContent;
import io.quarkiverse.mcp.server.Tool;
import io.quarkus.security.PermissionsAllowed;
import io.quarkus.security.identity.SecurityIdentity;
import jakarta.inject.Inject;

public class UserNameProvider {

    @Inject
    SecurityIdentity securityIdentity;

    @Tool(name = "user-name-provider", description = "Provides a name of the currently logged-in user") (1)
    @PermissionsAllowed("read:name") (2)
    TextContent provideUserName() {
        return new TextContent(securityIdentity.getPrincipal().getName()); (3)
    }
}

package io.quarkiverse.langchain4j.sample;

import io.quarkus.hibernate.orm.panache.PanacheEntity;
import jakarta.persistence.Column;
import jakarta.persistence.Entity;

@Entity
public class Identity extends PanacheEntity {
    @Column(unique = true)
    public String name;
    public String permission;

    public static Identity findByName(String name) { (1)
        return find("name", name).firstResult();
    }
}

INSERT INTO identity(id, name, permission) VALUES (1, '${user.name}', 'read:name'); (1)

package io.quarkiverse.langchain4j.sample;

import io.quarkus.security.identity.AuthenticationRequestContext;
import io.quarkus.security.identity.SecurityIdentity;
import io.quarkus.security.identity.SecurityIdentityAugmentor;
import io.quarkus.security.runtime.QuarkusSecurityIdentity;
import io.smallrye.mutiny.Uni;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.enterprise.context.control.ActivateRequestContext;
import jakarta.inject.Inject;

@ApplicationScoped
public class SecurityIdentityPermissionAugmentor implements SecurityIdentityAugmentor { (1)

    @Inject
    HibernateBlockingAugmentor hibernateBlockingAugmentor;

    @Override
    public Uni<SecurityIdentity> augment(SecurityIdentity identity, AuthenticationRequestContext context) {
        return context.runBlocking(() -> hibernateBlockingAugmentor.augment(identity)); (2)
    }

    @ApplicationScoped
    static class HibernateBlockingAugmentor {

        @ActivateRequestContext
        public SecurityIdentity augment(SecurityIdentity securityIdentity) {
            Identity identity = Identity.findByName(securityIdentity.getPrincipal().getName()); (3)

            QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder(securityIdentity); (4)
            return builder.addPermissionAsString(identity.permission).build(); (5)
        }
    }
}

quarkus.mcp.server.traffic-logging.enabled=true (1)
quarkus.mcp.server.traffic-logging.text-limit=1000

quarkus.http.auth.permission.authenticated.paths=/mcp/sse (2)
quarkus.http.auth.permission.authenticated.policy=authenticated

quarkus.oidc.provider=github (3)
quarkus.oidc.application-type=service (4)

quarkus.hibernate-orm.database.generation=drop-and-create (5)
quarkus.hibernate-orm.log.sql=true
quarkus.hibernate-orm.sql-load-script=import.sql

quarkus.http.port=8081 (6)

mvn quarkus:dev -Duser.name="Your GitHub account name" (1)

<dependency>
    <groupId>io.quarkiverse.langchain4j</groupId>
    <artifactId>quarkus-langchain4j-ai-gemini</artifactId> (1)
</dependency>
<dependency>
    <groupId>io.quarkiverse.langchain4j</groupId>
    <artifactId>quarkus-langchain4j-mcp</artifactId> (2)
</dependency>
<dependency>
    <groupId>io.quarkiverse.langchain4j</groupId>
    <artifactId>quarkus-langchain4j-oidc-mcp-auth-provider</artifactId> (3)
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-oidc</artifactId> (4)
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-rest-qute</artifactId> (5)
</dependency>

package io.quarkiverse.langchain4j.sample;

import io.quarkus.qute.Template;
import io.quarkus.qute.TemplateInstance;
import io.quarkus.oidc.UserInfo;
import io.quarkus.security.Authenticated;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.PathParam;
import jakarta.ws.rs.Produces;

/**
 * Login resource which returns a poem welcome page to the authenticated user
 */
@Path("/login")
@Authenticated (1)
public class LoginResource {

    @Inject
    UserInfo userInfo; (2)

    @Inject
    Template poem;

    @GET
    @Produces("text/html")
    public TemplateInstance poem() {
        return poem.data("name", userInfo.getName()); (3)
    }
}

package io.quarkiverse.langchain4j.sample;

import dev.langchain4j.agent.tool.Tool;
import dev.langchain4j.service.UserMessage;
import io.quarkiverse.langchain4j.RegisterAiService;
import io.quarkiverse.langchain4j.mcp.runtime.McpToolBox;
import io.quarkus.security.Authenticated;
import jakarta.inject.Inject;
import jakarta.inject.Singleton;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;

@Path("/poem")
@Authenticated (1)
public class PoemResource {

    static final String USER_MESSAGE = """
            Write a short 1 paragraph poem about a Java programming language.
            Please start by greeting the currently logged in user by name and asking to enjoy reading the poem.""";

    @RegisterAiService
    public interface PoemService { (2)
        @UserMessage(USER_MESSAGE)
        @McpToolBox("user-name") (3)
        String writePoem();
    }

    @Inject
    PoemService poemService;

    @GET
    public String getPoem() {
        return poemService.writePoem(); (4)
    }
}

quarkus.langchain4j.mcp.user-name.transport-type=http (1)
quarkus.langchain4j.mcp.user-name.url=http://localhost:8081/mcp/sse/ (2)

quarkus.oidc.provider=github (3)
quarkus.oidc.client-id=${github_client_id} (4)
quarkus.oidc.credentials.secret=${github_client_secret} (4)

quarkus.langchain4j.ai.gemini.api-key=${ai_gemini_api_key} (5)
quarkus.langchain4j.ai.gemini.log-requests=true (6)
quarkus.langchain4j.ai.gemini.log-responses=true

mvn quarkus:dev