-
Notifications
You must be signed in to change notification settings - Fork 183
Description
What is the bug?
When an agent attempts to use a tool from an externally configured Model Connector and Provider (MCP) server, the request fails with a ProtectionDomain access error. This prevents the agent from connecting to the external endpoint and utilizing its tools.
The configuration was done following the steps in the official documentation.
The following error is consistently logged when the agent tries to access a tool on the external MCP server:
Denied access to: my-mcp-endpoint:443, domain ProtectionDomain
It occurs when the external endpoint is configured with both HTTP and HTTPS.
How can one reproduce the bug?
Steps to reproduce the behavior:
- Follow the documentation doumentation
- OpenSearch Logs
[2025-09-26T15:15:18,580][ERROR][i.m.c.t.HttpClientSseClientTransport] [dev-opensearch-node-data-0] SSE connection error
java.util.concurrent.CompletionException: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain (jrt:/java.net.http <no signer certificates>)
jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
<no principals>
java.security.Permissions@4633b6d (
)
at java.base/java.util.concurrent.CompletableFuture.wrapInCompletionException(CompletableFuture.java:325) ~[?:?]
at java.base/java.util.concurrent.CompletableFuture.encodeRelay(CompletableFuture.java:414) ~[?:?]
at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1235) ~[?:?]
at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2393) ~[?:?]
at java.net.http/jdk.internal.net.http.MultiExchange.responseAsyncImpl(MultiExchange.java:483) ~[java.net.http:?]
at java.net.http/jdk.internal.net.http.MultiExchange.lambda$responseAsync0$0(MultiExchange.java:357) ~[java.net.http:?]
at java.base/java.util.concurrent.CompletableFuture$UniCompose.tryFire(CompletableFuture.java:1196) ~[?:?]
at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:556) ~[?:?]
at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1819) ~[?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095) ~[?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619) ~[?:?]
at java.base/java.lang.Thread.run(Thread.java:1447) [?:?]
Caused by: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain (jrt:/java.net.http <no signer certificates>)
jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
<no principals>
java.security.Permissions@4633b6d (
)
at java.base/sun.nio.ch.SocketChannelImpl.connect(SocketChannelImpl.java:936) ~[?:?]
at java.net.http/jdk.internal.net.http.PlainHttpConnection.connectAsync(PlainHttpConnection.java:203) ~[java.net.http:?]
at java.net.http/jdk.internal.net.http.AsyncSSLConnection.connectAsync(AsyncSSLConnection.java:56) ~[java.net.http:?]
at java.net.http/jdk.internal.net.http.Http1Exchange.sendHeadersAsync(Http1Exchange.java:312) ~[java.net.http:?]
at java.net.http/jdk.internal.net.http.Exchange.lambda$responseAsyncImpl$0(Exchange.java:559) ~[java.net.http:?]
at java.net.http/jdk.internal.net.http.Exchange.checkFor407(Exchange.java:408) ~[java.net.http:?]
at java.net.http/jdk.internal.net.http.Exchange.lambda$responseAsyncImpl$2(Exchange.java:563) ~[java.net.http:?]
at java.base/java.util.concurrent.CompletableFuture.uniHandle(CompletableFuture.java:980) ~[?:?]
at java.base/java.util.concurrent.CompletableFuture.uniHandleStage(CompletableFuture.java:996) ~[?:?]
at java.base/java.util.concurrent.CompletableFuture.handle(CompletableFuture.java:2424) ~[?:?]
at java.net.http/jdk.internal.net.http.Exchange.responseAsyncImpl(Exchange.java:563) ~[java.net.http:?]
at java.net.http/jdk.internal.net.http.Exchange.responseAsync(Exchange.java:385) ~[java.net.http:?]
at java.net.http/jdk.internal.net.http.MultiExchange.responseAsyncImpl(MultiExchange.java:437) ~[java.net.http:?]
... 7 more
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] [ERROR] (Thread-740) Operator called default onErrorDropped - reactor.core.Exceptions$ErrorCallbackNotImplemented: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain (jrt:/java.net.http <no signer certificates>)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] <no principals>
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] java.security.Permissions@4633b6d (
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] )
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] reactor.core.Exceptions$ErrorCallbackNotImplemented: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain (jrt:/java.net.http <no signer certificates>)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] <no principals>
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] java.security.Permissions@4633b6d (
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] )
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] Caused by: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain (jrt:/java.net.http <no signer certificates>)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] <no principals>
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] java.security.Permissions@4633b6d (
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] )
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/sun.nio.ch.SocketChannelImpl.connect(SocketChannelImpl.java:936)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.PlainHttpConnection.connectAsync(PlainHttpConnection.java:203)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.AsyncSSLConnection.connectAsync(AsyncSSLConnection.java:56)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.Http1Exchange.sendHeadersAsync(Http1Exchange.java:312)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.Exchange.lambda$responseAsyncImpl$0(Exchange.java:559)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.Exchange.checkFor407(Exchange.java:408)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.Exchange.lambda$responseAsyncImpl$2(Exchange.java:563)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.util.concurrent.CompletableFuture.uniHandle(CompletableFuture.java:980)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.util.concurrent.CompletableFuture.uniHandleStage(CompletableFuture.java:996)
[2025-09-26T15:15:18,581][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.util.concurrent.CompletableFuture.handle(CompletableFuture.java:2424)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.Exchange.responseAsyncImpl(Exchange.java:563)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.Exchange.responseAsync(Exchange.java:385)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.MultiExchange.responseAsyncImpl(MultiExchange.java:437)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.net.http/jdk.internal.net.http.MultiExchange.lambda$responseAsync0$0(MultiExchange.java:357)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.util.concurrent.CompletableFuture$UniCompose.tryFire(CompletableFuture.java:1196)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:556)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1819)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619)
[2025-09-26T15:15:18,582][WARN ][stderr ] [dev-opensearch-node-data-0] at java.base/java.lang.Thread.run(Thread.java:1447)
[2025-09-26T15:15:28,395][ERROR][o.o.m.e.a.a.AgentUtils ] [dev-opensearch-node-data-0] Failed to get tools from connector: WLoahpkBS7a6SdwPBhNB
org.opensearch.ml.common.exception.MLException: Unexpected error while getting MCP tools
at org.opensearch.ml.engine.algorithms.remote.McpConnectorExecutor.getMcpToolSpecs(McpConnectorExecutor.java:143) ~[opensearch-ml-algorithms-3.2.0.0.jar:?]
at org.opensearch.ml.engine.algorithms.agent.AgentUtils.lambda$getMCPToolSpecsFromConnector$0(AgentUtils.java:755) [opensearch-ml-algorithms-3.2.0.0.jar:?]
at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82) [opensearch-core-3.2.0.jar:3.2.0]
at org.opensearch.ml.engine.algorithms.agent.AgentUtils.lambda$getConnector$0(AgentUtils.java:807) [opensearch-ml-algorithms-3.2.0.0.jar:?]
at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:909) [?:?]
at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:887) [?:?]
at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:556) [?:?]
at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2231) [?:?]
at org.opensearch.remote.metadata.client.impl.LocalClusterIndicesClient.lambda$getDataObjectAsync$1(LocalClusterIndicesClient.java:148) [opensearch-remote-metadata-sdk-3.2.0.0.jar:?]
at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82) [opensearch-core-3.2.0.jar:3.2.0]
at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:298) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:284) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.security.transport.SecurityInterceptor$RestoringTransportResponseHandler.handleResponse(SecurityInterceptor.java:422) [opensearch-security-3.2.0.0.jar:3.2.0.0]
at org.opensearch.transport.TransportService$ContextRestoreResponseHandler.handleResponse(TransportService.java:1587) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.transport.TransportService$DirectResponseChannel.processResponse(TransportService.java:1680) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:1660) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.transport.TaskTransportChannel.sendResponse(TaskTransportChannel.java:72) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:62) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:45) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:975) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-3.2.0.jar:3.2.0]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095) [?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619) [?:?]
at java.base/java.lang.Thread.run(Thread.java:1447) [?:?]
Caused by: io.modelcontextprotocol.spec.McpError: Failed to wait for the message endpoint
at io.modelcontextprotocol.client.transport.HttpClientSseClientTransport.sendMessage(HttpClientSseClientTransport.java:401) ~[?:?]
at io.modelcontextprotocol.spec.McpClientSession.lambda$sendRequest$11(McpClientSession.java:232) ~[?:?]
at reactor.core.publisher.MonoCreate.subscribe(MonoCreate.java:61) ~[reactor-core-3.7.5.jar:3.7.5]
at reactor.core.publisher.Mono.subscribe(Mono.java:4576) ~[reactor-core-3.7.5.jar:3.7.5]
at reactor.core.publisher.Mono.block(Mono.java:1778) ~[reactor-core-3.7.5.jar:3.7.5]
at io.modelcontextprotocol.client.McpSyncClient.initialize(McpSyncClient.java:153) ~[mcp-0.9.0.jar:0.9.0]
at org.opensearch.ml.engine.algorithms.remote.McpConnectorExecutor.getMcpToolSpecs(McpConnectorExecutor.java:112) ~[opensearch-ml-algorithms-3.2.0.0.jar:?]
... 27 more
Suppressed: java.lang.Exception: #block terminated with an error
at reactor.core.publisher.BlockingSingleSubscriber.blockingGet(BlockingSingleSubscriber.java:104) ~[reactor-core-3.7.5.jar:3.7.5]
at reactor.core.publisher.Mono.block(Mono.java:1779) ~[reactor-core-3.7.5.jar:3.7.5]
at io.modelcontextprotocol.client.McpSyncClient.initialize(McpSyncClient.java:153) ~[mcp-0.9.0.jar:0.9.0]
at org.opensearch.ml.engine.algorithms.remote.McpConnectorExecutor.getMcpToolSpecs(McpConnectorExecutor.java:112) ~[opensearch-ml-algorithms-3.2.0.0.jar:?]
at org.opensearch.ml.engine.algorithms.agent.AgentUtils.lambda$getMCPToolSpecsFromConnector$0(AgentUtils.java:755) [opensearch-ml-algorithms-3.2.0.0.jar:?]
at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82) [opensearch-core-3.2.0.jar:3.2.0]
at org.opensearch.ml.engine.algorithms.agent.AgentUtils.lambda$getConnector$0(AgentUtils.java:807) [opensearch-ml-algorithms-3.2.0.0.jar:?]
at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:909) [?:?]
at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:887) [?:?]
at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:556) [?:?]
at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2231) [?:?]
at org.opensearch.remote.metadata.client.impl.LocalClusterIndicesClient.lambda$getDataObjectAsync$1(LocalClusterIndicesClient.java:148) [opensearch-remote-metadata-sdk-3.2.0.0.jar:?]
at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82) [opensearch-core-3.2.0.jar:3.2.0]
at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:298) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:284) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.security.transport.SecurityInterceptor$RestoringTransportResponseHandler.handleResponse(SecurityInterceptor.java:422) [opensearch-security-3.2.0.0.jar:3.2.0.0]
at org.opensearch.transport.TransportService$ContextRestoreResponseHandler.handleResponse(TransportService.java:1587) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.transport.TransportService$DirectResponseChannel.processResponse(TransportService.java:1680) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:1660) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.transport.TaskTransportChannel.sendResponse(TaskTransportChannel.java:72) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:62) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:45) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:975) [opensearch-3.2.0.jar:3.2.0]
at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-3.2.0.jar:3.2.0]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095) [?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619) [?:?]
at java.base/java.lang.Thread.run(Thread.java:1447) [?:?]
What is the expected behavior?
OpenSearch call my MCP agent and return the response.
What is your host/environment?
- OS: Amazon Linux
- Version 2023
- Plugins
|mapper-size
|opensearch-alerting
|opensearch-anomaly-detection
|
|opensearch-asynchronous-search
|opensearch-cross-cluster-replication
|opensearch-custom-codecs
|
|opensearch-flow-framework
|opensearch-geospatial
|opensearch-index-management
|
|opensearch-job-scheduler
|opensearch-knn
|opensearch-ltr
|
|opensearch-ml
|opensearch-neural-search
|opensearch-notifications
|
|opensearch-notifications-core
|opensearch-observability
|opensearch-performance-analyzer
|
|opensearch-reports-scheduler
|opensearch-search-relevance
|opensearch-security
|
|opensearch-security-analytics
|opensearch-skills
|opensearch-sql
|
|opensearch-system-templates
|opensearch-ubi
|query-insights
|
|repository-azure
|repository-s3
| |
Do you have any additional context?
I tried to run locally using the version 3.0 and 3.1 and this error not happens.
My MCP I made in python and use the /sse
to connect and run the questions.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status