Summary

• Add headersProvider (Supplier<Map>) to SseServerParameters and StreamableHttpServerParameters, evaluated per-request instead of frozen at construction time
• When set, headersProvider takes precedence over the static headers map
• Null-safe: guards against provider.get() returning null and wraps exceptions in Mono.error() (Streamable HTTP) / RuntimeException (SSE)
• @JsonIgnore on getter and builder setter to prevent Jackson serialization failures

Motivation

In multi-tenant applications (e.g. Spring Boot serving multiple authenticated users), each user has their own JWT token that must be forwarded to MCP servers requiring authentication. Currently, headers are frozen at McpToolset construction time, making per-user auth impossible without creating a new toolset per request.

Related: #1382

Changed files

• SseServerParameters.java — new headersProvider() abstract method + @JsonIgnore
• StreamableHttpServerParameters.java — new headersProvider field + builder method
• DefaultMcpTransportBuilder.java — resolve effective headers from provider or static map, with null/exception guards

Test plan

• SseServerParametersTest — builder accepts/stores Supplier, defaults to null
• StreamableHttpServerParametersTest — builder accepts/stores Supplier, defaults to null, static headers unaffected
• DefaultMcpTransportBuilderTest — provider called per-request (2x invocation count), provider takes precedence over static headers, null-returning provider does not throw, throwing provider returns Mono.error()
• All 64 existing MCP tests pass (backward compatible)