HTTP Transport

The HttpTransport class provides HTTP-based communication between MCP clients and WordPress servers through WordPress REST API endpoints. It processes JSON-RPC 2.0 messages sent via HTTP POST requests, manages sessions, and coordinates request routing to appropriate handlers.

HttpTransport is the primary transport for production deployments, enabling AI clients to interact with WordPress MCP servers over standard HTTP connections.

Class: includes/Transport/HttpTransport.php

Sources: README.md18-19 includes/Transport/HttpTransport.php

Key Components

Component	File	Purpose
HttpTransport	includes/Transport/HttpTransport.php	Main transport class, REST API integration
HttpRequestHandler	includes/Transport/Infrastructure/HttpRequestHandler.php	Routes HTTP methods, processes JSON-RPC
JsonRpcResponseBuilder	includes/Transport/Infrastructure/JsonRpcResponseBuilder.php	Creates JSON-RPC 2.0 responses
HttpSessionValidator	includes/Transport/Infrastructure/HttpSessionValidator.php	Session creation and validation
RequestRouter	includes/Transport/Infrastructure/RequestRouter.php	Routes MCP methods to handlers

Sources: includes/Transport/HttpTransport.php includes/Transport/Infrastructure/HttpRequestHandler.php21-37

REST API Integration

Route Registration

HttpTransport registers WordPress REST API routes during the rest_api_init hook. Each MCP server gets its own endpoint at the namespace and route specified in the server configuration.

Registration Flow:

1. WordPress fires rest_api_init hook
2. HttpTransport::register_routes() is called
3. Endpoint registered with namespace and route from McpServer configuration
4. Permission callback and request handler attached

Sources: includes/Transport/HttpTransport.php includes/Core/McpServer.php

Permission Checking

Permission Type	Implementation	Filter
Custom callback	Via transport_permission_callback in context	N/A
Default check	is_user_logged_in() && current_user_can()	mcp_adapter_default_transport_permission_user_capability

Default Capability: read (filterable)

Sources: includes/Transport/HttpTransport.php tests/Integration/HttpTransportTest.php508-708

HTTP Method Handling

HttpRequestHandler routes requests based on HTTP method:

HTTP Method	Handler Method	Status	Response
POST	handle_mcp_request()	Implemented	JSON-RPC 2.0
GET	handle_sse_request()	Not Implemented	405
DELETE	handle_session_termination()	Implemented	200 with null body
Other	N/A	N/A	405

Sources: includes/Transport/Infrastructure/HttpRequestHandler.php46-67 tests/Integration/HttpTransportTest.php76-398

HTTP Request Flow

Complete Request Processing

Key Steps:

1. Permission Check: HttpTransport::check_permission() validates access
2. Context Creation: HttpRequestContext wraps WP_REST_Request
3. Request Delegation: HttpRequestHandler::handle_request() processes HTTP method
4. JSON-RPC Validation: JsonRpcResponseBuilder::validate_jsonrpc_message() checks format
5. Session Management: HttpSessionValidator validates or creates sessions
6. Request Routing: RequestRouter::route_request() dispatches to handlers
7. Response Building: JsonRpcResponseBuilder formats JSON-RPC 2.0 response

Sources: includes/Transport/HttpTransport.php includes/Transport/Infrastructure/HttpRequestHandler.php46-131 includes/Transport/Infrastructure/RequestRouter.php51-130

JSON-RPC 2.0 Support

Request Message Format

HTTP Transport accepts JSON-RPC 2.0 messages in POST request body. Three message types are supported:

Message Structure:

Field	Type	Required	Description
jsonrpc	string	Yes	Must be "2.0"
id	string|number|null	For requests	Request identifier (omit for notifications)
method	string	Yes	MCP method (e.g., "tools/call", "initialize")
params	object	No	Method parameters

Example Request:

Sources: includes/Transport/Infrastructure/JsonRpcResponseBuilder.php tests/Integration/HttpTransportTest.php78-157

Response Message Format

Responses follow JSON-RPC 2.0 specification:

Success Response:

Error Response:

Sources: includes/Transport/Infrastructure/JsonRpcResponseBuilder.php tests/Integration/HttpTransportTest.php272-321

Message Validation

JsonRpcResponseBuilder::validate_jsonrpc_message() validates all incoming messages:

Validation Checks:

1. jsonrpc field must equal "2.0"
2. method field must be present and string
3. id field (if present) must be string, number, or null
4. params field (if present) must be object or array

Sources: includes/Transport/Infrastructure/JsonRpcResponseBuilder.php tests/Integration/HttpTransportTest.php216-249

Batch Request Processing

Multiple messages can be sent in a single HTTP request:

Processing Flow:

1. is_batch_request() detects array input
2. normalize_messages() converts single/batch to array
3. process_messages() executes callback for each message
4. Responses collected and returned as array (for batch) or single response

Sources: includes/Transport/Infrastructure/JsonRpcResponseBuilder.php tests/Integration/HttpTransportTest.php159-214

Required Methods

Constructor with Context Injection

Every transport implementation must accept a McpTransportContext through its constructor for dependency injection:

Method	Parameters	Purpose
__construct	McpTransportContext $context	Initialize transport with dependency container

The constructor signature at src/Transport/Contracts/McpTransportInterface.php28 ensures all transports receive the necessary dependencies for operation.

Permission Validation

The check_permission method provides transport-level access control:

Return Type	Meaning
true	User has permission to access MCP API
false	Access denied
WP_Error	Access denied with error details

This method at src/Transport/Contracts/McpTransportInterface.php35 allows each transport to implement protocol-specific permission logic while integrating with WordPress's permission system.

Request Handling

The handle_request method processes incoming requests according to the transport protocol:

The flexible parameter type mixed at src/Transport/Contracts/McpTransportInterface.php42 accommodates different request formats across transport protocols.

Route Registration

The register_routes method integrates the transport with WordPress's routing system:

This method at src/Transport/Contracts/McpTransportInterface.php53 is called during WordPress REST API initialization to establish protocol-specific endpoints.

Sources: src/Transport/Contracts/McpTransportInterface.php28-53

Interface Implementation Pattern

Transport implementations follow a consistent pattern when implementing the interface:

Sources: src/Transport/Contracts/McpTransportInterface.php21-54

Type Flexibility and Protocol Adaptation

The interface design accommodates different transport protocols through flexible typing:

Method	Parameter Type	Flexibility Reason
handle_request	mixed $request	Different protocols use different request objects
handle_request	Returns mixed	Response formats vary by protocol
check_permission	Returns bool|WP_Error	WordPress-compatible permission patterns

This design allows REST transports to work with WP_REST_Request objects while streaming transports can use different request formats, all while implementing the same interface contract.

Sources: src/Transport/Contracts/McpTransportInterface.php34-45