Reference

Spring runtime

The runtime is one dependency. It hosts the generated MCP server inside your application's own process, finds the manifest the build plugin produced, and registers one tool per capability, each calling your real service method.

The dependency

pom.xml

<dependency>
  <groupId>io.github.tibyaan-org</groupId>
  <artifactId>tibyan-runtime-spring</artifactId>
  <version>0.3.0</version>
</dependency>

The host application must be Spring Boot 3.x on Java 17 or later.

Launching

Run your application as usual. No launch property and no MCP block in application.yml are needed: the runtime finds the manifest on the classpath and registers the tools.

shell

java -jar target/your-app.jar

The MCP server is served over HTTP with Server-Sent Events at http://<host>:<port>/sse, on your application's own HTTP port (8080 by default). Point an MCP client that speaks the HTTP and SSE transport at it. A stdio-only client needs a bridge: see Connect an MCP client.

Manifest discovery order

The runtime looks for the manifest in a fixed order, and fails loudly if it finds none. It will not start silently serving nothing.

An explicit tibyan.capabilities location, if you set one. If it is set but nothing resolves there, that is a loud failure, not a fall-through to the defaults.
classpath:/tibyan/capabilities.json, where the build plugin puts it.
file:tibyan/capabilities.json, relative to the working directory.

Runtime properties

Property	Default	Effect
`tibyan.capabilities`	unset	Point the runtime at a specific manifest, overriding the default locations. Accepts Spring resource locations (`classpath:`, `file:`).
`tibyan.attested.expose`	`true`	Set to false for a verified-only surface: no attested capability is registered at all.
`tibyan.attested.exposeSecurityUnverifiable`	`false`	Attested reads whose declared security the tool could not compile do not register unless you opt in, once you have resolved what their declared security means.
`tibyan.attested.exposeBoundary`	`false`	Boundary attestations (remote delegations) do not register unless you opt in.

shell

# Run against a manifest produced by the CLI, sitting outside the classpath:
java "-Dtibyan.capabilities=file:generated/tibyan/capabilities.json" -jar target/your-app.jar

On Windows PowerShell, quote the whole property, as shown. The three tibyan.attested.* switches only matter if your project carries an attestations file.

How inputs are bound

The runtime binds each call's arguments to the target method's declared parameter types. A capability with an enum or date parameter invokes normally. When an input carries a closed set of values, read from an enum declared in your own source, both the manifest and the OpenAPI document render it as a closed set, and the runtime refuses an illegal value before invoking, naming the legal values.

Declared authorities

The manifest can carry the security contract your application declares on its own endpoints. Read the three states precisely:

In the manifest	Meaning
`requiredAuthorities`	Your application declares that a caller must hold at least one of these authorities for this read. The tool carries the declaration; it does not enforce it.
`securityUnverifiable`	A security declaration exists that the tool could not compile completely. Treat the capability as gated until a person resolves what the declaration means.
Neither	No method-security declaration was found on the read or its controller endpoints. This is not a statement that the read is unprotected: URL-level rules in your security filter chain are invisible to this analysis.

The declared contract is carried so that your own enforcement layer, the gateway or orchestration in front of the MCP endpoint, can apply it before invoking a capability.

Security

The runtime enforces nothing

The adapter calls your service bean directly, not your controller, so your HTTP security is bypassed. The generated server executes real methods against real data and adds no authentication of its own. Gating /sse is your responsibility. Read Security before you expose it.

The authoritative text is docs/COMMANDS.md, section 4 (opens in a new tab) in the repository. If this page and that document ever disagree, the repository wins.