fix(laravel): honor mcp.enabled and add mcp.middleware

src/Laravel/ApiPlatformProvider.php

@@ -1032,7 +1032,7 @@ public function register(): void
             $this->registerGraphQl();
         }
 
-        if (class_exists(McpController::class)) {
+        if (class_exists(McpController::class) && $this->app['config']->get('api-platform.mcp.enabled', true)) {
             $this->registerMcp();
         }
 

src/Laravel/Tests/McpDisabledTest.php

@@ -0,0 +1,63 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Laravel\Tests;
+
+use Illuminate\Config\Repository;
+use Illuminate\Foundation\Application;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Orchestra\Testbench\Concerns\WithWorkbench;
+use Orchestra\Testbench\TestCase;
+use Symfony\AI\McpBundle\McpBundle;
+
+class McpDisabledTest extends TestCase
+{
+    use RefreshDatabase;
+    use WithWorkbench;
+
+    /**
+     * @param Application $app
+     */
+    protected function defineEnvironment($app): void
+    {
+        tap($app['config'], static function (Repository $config): void {
+            $config->set('api-platform.mcp.enabled', false);
+        });
+    }
+
+    public function testMcpEndpointIsNotRegisteredWhenDisabled(): void
+    {
+        if (!class_exists(McpBundle::class)) {
+            $this->markTestSkipped('MCP bundle is not installed');
+        }
+
+        $response = $this->postJson('/mcp', [
+            'jsonrpc' => '2.0',
+            'id' => 1,
+            'method' => 'initialize',
+            'params' => [
+                'protocolVersion' => '2024-11-05',
+                'clientInfo' => [
+                    'name' => 'ApiPlatform Test Suite',
+                    'version' => '1.0',
+                ],
+                'capabilities' => [],
+            ],
+        ], [
+            'Accept' => 'application/json, text/event-stream',
+            'Content-Type' => 'application/json',
+        ]);
+
+        $response->assertNotFound();
+    }
+}

src/Laravel/Tests/McpMiddlewareTest.php

@@ -0,0 +1,64 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Laravel\Tests;
+
+use Illuminate\Config\Repository;
+use Illuminate\Foundation\Application;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Orchestra\Testbench\Concerns\WithWorkbench;
+use Orchestra\Testbench\TestCase;
+use Symfony\AI\McpBundle\McpBundle;
+
+class McpMiddlewareTest extends TestCase
+{
+    use RefreshDatabase;
+    use WithWorkbench;
+
+    /**
+     * @param Application $app
+     */
+    protected function defineEnvironment($app): void
+    {
+        tap($app['config'], static function (Repository $config): void {
+            $config->set('app.key', 'AckfSECXIvnK5r28GVIWUAxmbBSjTsmF');
+            $config->set('api-platform.mcp.middleware', ['auth:sanctum']);
+        });
+    }
+
+    public function testMcpEndpointAppliesConfiguredMiddleware(): void
+    {
+        if (!class_exists(McpBundle::class)) {
+            $this->markTestSkipped('MCP bundle is not installed');
+        }
+
+        $response = $this->postJson('/mcp', [
+            'jsonrpc' => '2.0',
+            'id' => 1,
+            'method' => 'initialize',
+            'params' => [
+                'protocolVersion' => '2024-11-05',
+                'clientInfo' => [
+                    'name' => 'ApiPlatform Test Suite',
+                    'version' => '1.0',
+                ],
+                'capabilities' => [],
+            ],
+        ], [
+            'Accept' => 'application/json, text/event-stream',
+            'Content-Type' => 'application/json',
+        ]);
+
+        $response->assertUnauthorized();
+    }
+}

src/Laravel/config/api-platform.php

@@ -195,6 +195,7 @@
     // MCP (Model Context Protocol) configuration
     'mcp' => [
         'enabled' => true,
+        'middleware' => [],
     ],
 
     // install `api-platform/http-cache`

src/Laravel/routes/api.php

@@ -121,7 +121,7 @@
 });
 
 // MCP endpoint (outside the API prefix)
-if (class_exists(McpController::class)) {
+if (class_exists(McpController::class) && config()->get('api-platform.mcp.enabled', true)) {
     Route::match(['GET', 'POST', 'DELETE', 'OPTIONS'], '/mcp', static function (Request $request) {
         $requestStack = app(RequestStack::class);
         $mcpController = app(McpController::class);
@@ -134,5 +134,5 @@
         } finally {
             $requestStack->pop();
         }
-    })->name('api_mcp');
+    })->name('api_mcp')->middleware(config()->get('api-platform.mcp.middleware', []));
 }