Add Model Context Protocol (MCP) API

gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/AbstractSpringBootApplication.java

@@ -90,6 +90,7 @@ public FilterRegistrationBean<MidPointProfilingServletFilter> midPointProfilingS
         FilterRegistrationBean<MidPointProfilingServletFilter> registration = new FilterRegistrationBean<>();
         registration.setFilter(new MidPointProfilingServletFilter());
         registration.addUrlPatterns("/*");
+        registration.setAsyncSupported(true);
         return registration;
     }
 
@@ -100,6 +101,7 @@ public FilterRegistrationBean<BrowserWindowIdentifierFilter> browserWindowIdenti
         registration.addUrlPatterns("/*");
         // Ensure it runs before Wicket filter by giving it a higher precedence (lower order value)
         registration.setOrder(-100);
+        registration.setAsyncSupported(true);
 
         return registration;
     }
@@ -116,6 +118,7 @@ public FilterRegistrationBean<WicketFilter> wicket() {
         registration.addInitParameter(Application.CONFIGURATION, "deployment");
         registration.addInitParameter("applicationBean", "midpointApplication");
         registration.addInitParameter(WicketFilter.APP_FACT_PARAM, "org.apache.wicket.spring.SpringWebApplicationFactory");
+        registration.setAsyncSupported(true);
 
         return registration;
     }
@@ -128,6 +131,7 @@ public FilterRegistrationBean<DelegatingFilterProxy> springSecurityFilterChain()
         FilterRegistrationBean<DelegatingFilterProxy> registration = new FilterRegistrationBean<>();
         registration.setFilter(new DelegatingFilterProxy());
         registration.addUrlPatterns("/*");
+        registration.setAsyncSupported(true);
         return registration;
     }
 

gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/MidPointSpringApplication.java

@@ -73,6 +73,7 @@
         "classpath:ctx-security-enforcer.xml",
         "classpath:ctx-model.xml",
         "classpath:ctx-model-common.xml",
+        "classpath:ctx-mcp.xml",
         "classpath:ctx-authentication.xml",
         "classpath:ctx-report.xml",
         "classpath:ctx-smart-integration.xml",

gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/NodeIdHeaderValve.java

@@ -25,7 +25,9 @@ public class NodeIdHeaderValve extends ValveBase {
     private TaskManager taskManager;
 
     public NodeIdHeaderValve(TaskManager taskManager) {
-        super();
+        // MCP stream transport (SSE) requires Servlet async I/O.
+        // Tomcat checks async support per valve/filter/servlet chain element.
+        super(true);
 
         this.taskManager = taskManager;
     }

gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/TomcatRootValve.java

@@ -36,7 +36,9 @@ public class TomcatRootValve extends ValveBase {
     private String servletPath;
 
     public TomcatRootValve(String servletPath) {
-        super();
+        // MCP stream transport (SSE) requires Servlet async I/O.
+        // Tomcat checks async support per valve/filter/servlet chain element.
+        super(true);
 
         this.servletPath = servletPath == null ? "" : servletPath;
     }

gui/admin-gui/src/test/java/com/evolveum/midpoint/gui/test/TestMidPointSpringApplication.java

@@ -50,6 +50,7 @@
         "classpath:ctx-model.xml",
         "classpath:ctx-model-test.xml",
         "classpath:ctx-model-common.xml",
+        "classpath:ctx-mcp.xml",
         "classpath:ctx-init.xml",
         "classpath:ctx-authentication.xml",
         "classpath:ctx-report.xml",

gui/midpoint-jar/pom.xml

@@ -29,6 +29,12 @@
             <version>${project.version}</version>
             <scope>runtime</scope>
         </dependency>
+        <dependency>
+            <groupId>com.evolveum.midpoint.model</groupId>
+            <artifactId>mcp-impl</artifactId>
+            <version>${project.version}</version>
+            <scope>runtime</scope>
+        </dependency>
     	<dependency>
           <groupId>net.bytebuddy</groupId>
           <artifactId>byte-buddy</artifactId>

model/authentication-api/src/main/java/com/evolveum/midpoint/authentication/api/authorization/EndPointsUrlMapping.java

@@ -234,6 +234,11 @@ public enum EndPointsUrlMapping {
      * This is the authorization that provides access to all the methods. However, it is possible to authorize selected
      * REST actions individually; see {@link RestAuthorizationAction} enum.
      */
+    MCP("/ws/mcp/**",
+            new AuthorizationActionValue(RestAuthorizationAction.GET_OBJECT.getUri(),
+                    "RestEndpoint.authRest.getObject.label", "RestEndpoint.authRest.getObject.description"),
+            new AuthorizationActionValue(RestAuthorizationAction.SEARCH_OBJECTS.getUri(),
+                    "RestEndpoint.authRest.searchObjects.label", "RestEndpoint.authRest.searchObjects.description")),
     REST("/ws/**",
             new AuthorizationActionValue(AUTZ_REST_ALL_URL,
                     "RestEndpoint.authRest.all.label", "RestEndpoint.authRest.all.description")),

model/mcp-api/pom.xml

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright (C) 2010-2026 Evolveum and contributors
+  ~
+  ~ Licensed under the EUPL-1.2 or later.
+  -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <artifactId>model</artifactId>
+        <groupId>com.evolveum.midpoint.model</groupId>
+        <version>4.11-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>mcp-api</artifactId>
+    <packaging>jar</packaging>
+
+    <name>midPoint MCP Layer - api</name>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.evolveum.midpoint.infra</groupId>
+            <artifactId>schema</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.evolveum.midpoint.repo</groupId>
+            <artifactId>task-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
+    </dependencies>
+</project>

model/mcp-api/src/main/java/com/evolveum/midpoint/mcp/api/McpPublicErrorMessages.java

@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2010-2026 Evolveum and contributors
+ *
+ * Licensed under the EUPL-1.2 or later.
+ */
+
+package com.evolveum.midpoint.mcp.api;
+
+/**
+ * Stable, client-facing error text (no internal exception details).
+ */
+public final class McpPublicErrorMessages {
+
+    public static final String NOT_FOUND = "The requested object was not found.";
+
+    public static final String ACCESS_DENIED = "Access denied.";
+
+    public static final String INTERNAL_ERROR = "An error occurred while processing the request.";
+
+    public static final String UNEXPECTED_TOOL_FAILURE = "An unexpected error occurred while handling the tool request.";
+
+    public static final String SERIALIZATION_FAILED = "Response serialization failed.";
+
+    private McpPublicErrorMessages() {}
+}

model/mcp-api/src/main/java/com/evolveum/midpoint/mcp/api/MidpointMcpActivationView.java

@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2010-2026 Evolveum and contributors
+ *
+ * Licensed under the EUPL-1.2 or later.
+ */
+
+package com.evolveum.midpoint.mcp.api;
+
+/**
+ * JSON-friendly snapshot of midPoint {@code ActivationType} for MCP explain/search responses.
+ * All fields are optional; {@code null} means unknown or not set in the source object.
+ */
+public class MidpointMcpActivationView {
+
+    private String administrativeStatus;
+    private String effectiveStatus;
+    private String validityStatus;
+    private String validFrom;
+    private String validTo;
+    private String lockoutStatus;
+    private String disableReason;
+    private String enableTimestamp;
+    private String disableTimestamp;
+    private String archiveTimestamp;
+    private String validityChangeTimestamp;
+    private String lockoutExpirationTimestamp;
+
+    public String getAdministrativeStatus() {
+        return administrativeStatus;
+    }
+
+    public void setAdministrativeStatus(String administrativeStatus) {
+        this.administrativeStatus = administrativeStatus;
+    }
+
+    public String getEffectiveStatus() {
+        return effectiveStatus;
+    }
+
+    public void setEffectiveStatus(String effectiveStatus) {
+        this.effectiveStatus = effectiveStatus;
+    }
+
+    public String getValidityStatus() {
+        return validityStatus;
+    }
+
+    public void setValidityStatus(String validityStatus) {
+        this.validityStatus = validityStatus;
+    }
+
+    public String getValidFrom() {
+        return validFrom;
+    }
+
+    public void setValidFrom(String validFrom) {
+        this.validFrom = validFrom;
+    }
+
+    public String getValidTo() {
+        return validTo;
+    }
+
+    public void setValidTo(String validTo) {
+        this.validTo = validTo;
+    }
+
+    public String getLockoutStatus() {
+        return lockoutStatus;
+    }
+
+    public void setLockoutStatus(String lockoutStatus) {
+        this.lockoutStatus = lockoutStatus;
+    }
+
+    public String getDisableReason() {
+        return disableReason;
+    }
+
+    public void setDisableReason(String disableReason) {
+        this.disableReason = disableReason;
+    }
+
+    public String getEnableTimestamp() {
+        return enableTimestamp;
+    }
+
+    public void setEnableTimestamp(String enableTimestamp) {
+        this.enableTimestamp = enableTimestamp;
+    }
+
+    public String getDisableTimestamp() {
+        return disableTimestamp;
+    }
+
+    public void setDisableTimestamp(String disableTimestamp) {
+        this.disableTimestamp = disableTimestamp;
+    }
+
+    public String getArchiveTimestamp() {
+        return archiveTimestamp;
+    }
+
+    public void setArchiveTimestamp(String archiveTimestamp) {
+        this.archiveTimestamp = archiveTimestamp;
+    }
+
+    public String getValidityChangeTimestamp() {
+        return validityChangeTimestamp;
+    }
+
+    public void setValidityChangeTimestamp(String validityChangeTimestamp) {
+        this.validityChangeTimestamp = validityChangeTimestamp;
+    }
+
+    public String getLockoutExpirationTimestamp() {
+        return lockoutExpirationTimestamp;
+    }
+
+    public void setLockoutExpirationTimestamp(String lockoutExpirationTimestamp) {
+        this.lockoutExpirationTimestamp = lockoutExpirationTimestamp;
+    }
+}

model/mcp-api/src/main/java/com/evolveum/midpoint/mcp/api/MidpointMcpAdvancedFilterSpec.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2010-2026 Evolveum and contributors
+ *
+ * Licensed under the EUPL-1.2 or later.
+ */
+
+package com.evolveum.midpoint.mcp.api;
+
+/**
+ * One filter in {@link MidpointMcpAdvancedQuerySpec#getFilters()}.
+ * {@code value} is JSON-driven: string, number, boolean, or array of strings (for {@code in}).
+ */
+public class MidpointMcpAdvancedFilterSpec {
+
+    private String path;
+    /**
+     * One of: {@code eq}, {@code neq}, {@code startsWith}, {@code contains}, {@code gt}, {@code gte},
+     * {@code lt}, {@code lte}, {@code exists}, {@code in}.
+     */
+    private String op;
+    /** Omitted for {@code exists}. */
+    private Object value;
+
+    public String getPath() {
+        return path;
+    }
+
+    public void setPath(String path) {
+        this.path = path;
+    }
+
+    public String getOp() {
+        return op;
+    }
+
+    public void setOp(String op) {
+        this.op = op;
+    }
+
+    public Object getValue() {
+        return value;
+    }
+
+    public void setValue(Object value) {
+        this.value = value;
+    }
+}

model/mcp-api/src/main/java/com/evolveum/midpoint/mcp/api/MidpointMcpAdvancedOrderBySpec.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2010-2026 Evolveum and contributors
+ *
+ * Licensed under the EUPL-1.2 or later.
+ */
+
+package com.evolveum.midpoint.mcp.api;
+
+/**
+ * Sort instruction for {@link MidpointMcpAdvancedQuerySpec}; path uses MCP dot notation.
+ */
+public class MidpointMcpAdvancedOrderBySpec {
+
+    private String path;
+    /** {@code asc} or {@code desc}; default ascending when omitted. */
+    private String direction;
+
+    public String getPath() {
+        return path;
+    }
+
+    public void setPath(String path) {
+        this.path = path;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    public void setDirection(String direction) {
+        this.direction = direction;
+    }
+}

model/mcp-api/src/main/java/com/evolveum/midpoint/mcp/api/MidpointMcpAdvancedPagingSpec.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2010-2026 Evolveum and contributors
+ *
+ * Licensed under the EUPL-1.2 or later.
+ */
+
+package com.evolveum.midpoint.mcp.api;
+
+/**
+ * Optional paging inside {@link MidpointMcpAdvancedQuerySpec}; when present, overrides top-level
+ * {@link MidpointMcpSearchRequest#getLimit()}/{@link MidpointMcpSearchRequest#getOffset()}.
+ */
+public class MidpointMcpAdvancedPagingSpec {
+
+    private Integer offset;
+    private Integer limit;
+
+    public Integer getOffset() {
+        return offset;
+    }
+
+    public void setOffset(Integer offset) {
+        this.offset = offset;
+    }
+
+    public Integer getLimit() {
+        return limit;
+    }
+
+    public void setLimit(Integer limit) {
+        this.limit = limit;
+    }
+}