Skip to content

[BUG] Failed to get tools from external MCP server #4209

@kalilventura

Description

@kalilventura

What is the bug?
When an agent attempts to use a tool from an externally configured Model Connector and Provider (MCP) server, the request fails with a ProtectionDomain access error. This prevents the agent from connecting to the external endpoint and utilizing its tools.

The configuration was done following the steps in the official documentation.

The following error is consistently logged when the agent tries to access a tool on the external MCP server:
Denied access to: my-mcp-endpoint:443, domain ProtectionDomain
It occurs when the external endpoint is configured with both HTTP and HTTPS.

How can one reproduce the bug?
Steps to reproduce the behavior:

  1. Follow the documentation doumentation
  2. OpenSearch Logs
[2025-09-26T15:15:18,580][ERROR][i.m.c.t.HttpClientSseClientTransport] [dev-opensearch-node-data-0] SSE connection error
java.util.concurrent.CompletionException: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain  (jrt:/java.net.http <no signer certificates>)
 jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
 <no principals>
 java.security.Permissions@4633b6d (
)
	at java.base/java.util.concurrent.CompletableFuture.wrapInCompletionException(CompletableFuture.java:325) ~[?:?]
	at java.base/java.util.concurrent.CompletableFuture.encodeRelay(CompletableFuture.java:414) ~[?:?]
	at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1235) ~[?:?]
	at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2393) ~[?:?]
	at java.net.http/jdk.internal.net.http.MultiExchange.responseAsyncImpl(MultiExchange.java:483) ~[java.net.http:?]
	at java.net.http/jdk.internal.net.http.MultiExchange.lambda$responseAsync0$0(MultiExchange.java:357) ~[java.net.http:?]
	at java.base/java.util.concurrent.CompletableFuture$UniCompose.tryFire(CompletableFuture.java:1196) ~[?:?]
	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:556) ~[?:?]
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1819) ~[?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095) ~[?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619) ~[?:?]
	at java.base/java.lang.Thread.run(Thread.java:1447) [?:?]
Caused by: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain  (jrt:/java.net.http <no signer certificates>)
 jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
 <no principals>
 java.security.Permissions@4633b6d (
)
	at java.base/sun.nio.ch.SocketChannelImpl.connect(SocketChannelImpl.java:936) ~[?:?]
	at java.net.http/jdk.internal.net.http.PlainHttpConnection.connectAsync(PlainHttpConnection.java:203) ~[java.net.http:?]
	at java.net.http/jdk.internal.net.http.AsyncSSLConnection.connectAsync(AsyncSSLConnection.java:56) ~[java.net.http:?]
	at java.net.http/jdk.internal.net.http.Http1Exchange.sendHeadersAsync(Http1Exchange.java:312) ~[java.net.http:?]
	at java.net.http/jdk.internal.net.http.Exchange.lambda$responseAsyncImpl$0(Exchange.java:559) ~[java.net.http:?]
	at java.net.http/jdk.internal.net.http.Exchange.checkFor407(Exchange.java:408) ~[java.net.http:?]
	at java.net.http/jdk.internal.net.http.Exchange.lambda$responseAsyncImpl$2(Exchange.java:563) ~[java.net.http:?]
	at java.base/java.util.concurrent.CompletableFuture.uniHandle(CompletableFuture.java:980) ~[?:?]
	at java.base/java.util.concurrent.CompletableFuture.uniHandleStage(CompletableFuture.java:996) ~[?:?]
	at java.base/java.util.concurrent.CompletableFuture.handle(CompletableFuture.java:2424) ~[?:?]
	at java.net.http/jdk.internal.net.http.Exchange.responseAsyncImpl(Exchange.java:563) ~[java.net.http:?]
	at java.net.http/jdk.internal.net.http.Exchange.responseAsync(Exchange.java:385) ~[java.net.http:?]
	at java.net.http/jdk.internal.net.http.MultiExchange.responseAsyncImpl(MultiExchange.java:437) ~[java.net.http:?]
	... 7 more
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] [ERROR] (Thread-740) Operator called default onErrorDropped - reactor.core.Exceptions$ErrorCallbackNotImplemented: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain  (jrt:/java.net.http <no signer certificates>)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  <no principals>
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  java.security.Permissions@4633b6d (
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] )
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] reactor.core.Exceptions$ErrorCallbackNotImplemented: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain  (jrt:/java.net.http <no signer certificates>)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  <no principals>
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  java.security.Permissions@4633b6d (
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] )
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] Caused by: java.lang.SecurityException: Denied access to: my-mcp-endpoint:443, domain ProtectionDomain  (jrt:/java.net.http <no signer certificates>)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  jdk.internal.loader.ClassLoaders$PlatformClassLoader@d8948cd
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  <no principals>
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0]  java.security.Permissions@4633b6d (
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] )
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/sun.nio.ch.SocketChannelImpl.connect(SocketChannelImpl.java:936)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.PlainHttpConnection.connectAsync(PlainHttpConnection.java:203)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.AsyncSSLConnection.connectAsync(AsyncSSLConnection.java:56)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.Http1Exchange.sendHeadersAsync(Http1Exchange.java:312)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.Exchange.lambda$responseAsyncImpl$0(Exchange.java:559)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.Exchange.checkFor407(Exchange.java:408)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.Exchange.lambda$responseAsyncImpl$2(Exchange.java:563)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.util.concurrent.CompletableFuture.uniHandle(CompletableFuture.java:980)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.util.concurrent.CompletableFuture.uniHandleStage(CompletableFuture.java:996)
[2025-09-26T15:15:18,581][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.util.concurrent.CompletableFuture.handle(CompletableFuture.java:2424)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.Exchange.responseAsyncImpl(Exchange.java:563)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.Exchange.responseAsync(Exchange.java:385)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.MultiExchange.responseAsyncImpl(MultiExchange.java:437)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.net.http/jdk.internal.net.http.MultiExchange.lambda$responseAsync0$0(MultiExchange.java:357)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.util.concurrent.CompletableFuture$UniCompose.tryFire(CompletableFuture.java:1196)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:556)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1819)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619)
[2025-09-26T15:15:18,582][WARN ][stderr                   ] [dev-opensearch-node-data-0] 	at java.base/java.lang.Thread.run(Thread.java:1447)
[2025-09-26T15:15:28,395][ERROR][o.o.m.e.a.a.AgentUtils   ] [dev-opensearch-node-data-0] Failed to get tools from connector: WLoahpkBS7a6SdwPBhNB
org.opensearch.ml.common.exception.MLException: Unexpected error while getting MCP tools
	at org.opensearch.ml.engine.algorithms.remote.McpConnectorExecutor.getMcpToolSpecs(McpConnectorExecutor.java:143) ~[opensearch-ml-algorithms-3.2.0.0.jar:?]
	at org.opensearch.ml.engine.algorithms.agent.AgentUtils.lambda$getMCPToolSpecsFromConnector$0(AgentUtils.java:755) [opensearch-ml-algorithms-3.2.0.0.jar:?]
	at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82) [opensearch-core-3.2.0.jar:3.2.0]
	at org.opensearch.ml.engine.algorithms.agent.AgentUtils.lambda$getConnector$0(AgentUtils.java:807) [opensearch-ml-algorithms-3.2.0.0.jar:?]
	at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:909) [?:?]
	at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:887) [?:?]
	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:556) [?:?]
	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2231) [?:?]
	at org.opensearch.remote.metadata.client.impl.LocalClusterIndicesClient.lambda$getDataObjectAsync$1(LocalClusterIndicesClient.java:148) [opensearch-remote-metadata-sdk-3.2.0.0.jar:?]
	at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82) [opensearch-core-3.2.0.jar:3.2.0]
	at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:298) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:284) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.security.transport.SecurityInterceptor$RestoringTransportResponseHandler.handleResponse(SecurityInterceptor.java:422) [opensearch-security-3.2.0.0.jar:3.2.0.0]
	at org.opensearch.transport.TransportService$ContextRestoreResponseHandler.handleResponse(TransportService.java:1587) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.transport.TransportService$DirectResponseChannel.processResponse(TransportService.java:1680) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:1660) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.transport.TaskTransportChannel.sendResponse(TaskTransportChannel.java:72) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:62) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:45) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:975) [opensearch-3.2.0.jar:3.2.0]
	at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-3.2.0.jar:3.2.0]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095) [?:?]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619) [?:?]
	at java.base/java.lang.Thread.run(Thread.java:1447) [?:?]
Caused by: io.modelcontextprotocol.spec.McpError: Failed to wait for the message endpoint
	at io.modelcontextprotocol.client.transport.HttpClientSseClientTransport.sendMessage(HttpClientSseClientTransport.java:401) ~[?:?]
	at io.modelcontextprotocol.spec.McpClientSession.lambda$sendRequest$11(McpClientSession.java:232) ~[?:?]
	at reactor.core.publisher.MonoCreate.subscribe(MonoCreate.java:61) ~[reactor-core-3.7.5.jar:3.7.5]
	at reactor.core.publisher.Mono.subscribe(Mono.java:4576) ~[reactor-core-3.7.5.jar:3.7.5]
	at reactor.core.publisher.Mono.block(Mono.java:1778) ~[reactor-core-3.7.5.jar:3.7.5]
	at io.modelcontextprotocol.client.McpSyncClient.initialize(McpSyncClient.java:153) ~[mcp-0.9.0.jar:0.9.0]
	at org.opensearch.ml.engine.algorithms.remote.McpConnectorExecutor.getMcpToolSpecs(McpConnectorExecutor.java:112) ~[opensearch-ml-algorithms-3.2.0.0.jar:?]
	... 27 more
	Suppressed: java.lang.Exception: #block terminated with an error
		at reactor.core.publisher.BlockingSingleSubscriber.blockingGet(BlockingSingleSubscriber.java:104) ~[reactor-core-3.7.5.jar:3.7.5]
		at reactor.core.publisher.Mono.block(Mono.java:1779) ~[reactor-core-3.7.5.jar:3.7.5]
		at io.modelcontextprotocol.client.McpSyncClient.initialize(McpSyncClient.java:153) ~[mcp-0.9.0.jar:0.9.0]
		at org.opensearch.ml.engine.algorithms.remote.McpConnectorExecutor.getMcpToolSpecs(McpConnectorExecutor.java:112) ~[opensearch-ml-algorithms-3.2.0.0.jar:?]
		at org.opensearch.ml.engine.algorithms.agent.AgentUtils.lambda$getMCPToolSpecsFromConnector$0(AgentUtils.java:755) [opensearch-ml-algorithms-3.2.0.0.jar:?]
		at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82) [opensearch-core-3.2.0.jar:3.2.0]
		at org.opensearch.ml.engine.algorithms.agent.AgentUtils.lambda$getConnector$0(AgentUtils.java:807) [opensearch-ml-algorithms-3.2.0.0.jar:?]
		at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:909) [?:?]
		at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:887) [?:?]
		at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:556) [?:?]
		at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2231) [?:?]
		at org.opensearch.remote.metadata.client.impl.LocalClusterIndicesClient.lambda$getDataObjectAsync$1(LocalClusterIndicesClient.java:148) [opensearch-remote-metadata-sdk-3.2.0.0.jar:?]
		at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82) [opensearch-core-3.2.0.jar:3.2.0]
		at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:298) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:284) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.security.transport.SecurityInterceptor$RestoringTransportResponseHandler.handleResponse(SecurityInterceptor.java:422) [opensearch-security-3.2.0.0.jar:3.2.0.0]
		at org.opensearch.transport.TransportService$ContextRestoreResponseHandler.handleResponse(TransportService.java:1587) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.transport.TransportService$DirectResponseChannel.processResponse(TransportService.java:1680) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:1660) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.transport.TaskTransportChannel.sendResponse(TaskTransportChannel.java:72) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:62) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:45) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:975) [opensearch-3.2.0.jar:3.2.0]
		at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-3.2.0.jar:3.2.0]
		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1095) [?:?]
		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:619) [?:?]
		at java.base/java.lang.Thread.run(Thread.java:1447) [?:?]

What is the expected behavior?
OpenSearch call my MCP agent and return the response.

What is your host/environment?

  • OS: Amazon Linux
  • Version 2023
  • Plugins
    | mapper-size | opensearch-alerting | opensearch-anomaly-detection |
    | opensearch-asynchronous-search | opensearch-cross-cluster-replication | opensearch-custom-codecs |
    | opensearch-flow-framework | opensearch-geospatial | opensearch-index-management |
    | opensearch-job-scheduler | opensearch-knn | opensearch-ltr |
    | opensearch-ml | opensearch-neural-search | opensearch-notifications |
    | opensearch-notifications-core | opensearch-observability | opensearch-performance-analyzer |
    | opensearch-reports-scheduler | opensearch-search-relevance | opensearch-security |
    | opensearch-security-analytics | opensearch-skills | opensearch-sql |
    | opensearch-system-templates | opensearch-ubi | query-insights |
    | repository-azure | repository-s3 | |

Do you have any additional context?
I tried to run locally using the version 3.0 and 3.1 and this error not happens.

My MCP I made in python and use the /sse to connect and run the questions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions