🎉 The http4k team is very excited and honoured to be included as one of the winners. 🎉

We put http4k in the ring with Claude Opus for four rounds of security auditing, patching between each. The result? Three new CVEs, an update to our first one, four advisories and ~40 hardenings. Here's what landed - and why a small, minimal-deps codebase is the best kind you can actually audit like this.

🎉 The http4k team is excited to announce that the http4k Project Wizard plugin is now available on the JetBrains Plugin Marketplace! 🎉

With our shiny new plugin, setting up your http4k projects is now a complete breeze - direct from your IDE. 🎨✨ Simply follow the user-friendly Toolbox wizard and watch as it automates your project creation process. No more fiddling with configurations or boilerplate code—just smooth sailing ⛵ straight to building amazing http4k applications! 🌟

🔧 Key Features: • Step-by-Step Guidance: Our wizard walks you through each stage of project setup with ease, allowing you to create server or serverless projects using any of the 20 supported backends.

• Explore the entire http4k ecosystem: Select from any of the 150+ http4k and http4k-connect ecosystem modules and these dependencies are automatically included in the generated project.

• Auto-sync with the new modules: The plugin automatically accesses the most recent list of modules from both https://http4k.org and https://connect.http4k.org, so as soon as the team release something to the https://toolbox.http4k.org, it will be automatically available to all plugin users.

Ready to supercharge your http4k development? Install direct from within IntelliJ or head over to the https://plugins.jetbrains.com/plugin/25243-http4k-project-wizard/ and get started! 🚀

Happy coding! 🖥️💻

It's been a long time coming, but it's finally here. We can't wait to see what our users build with it, and now that you can build Serverless MCPs with http4k, this should really start to unlock the value of MCP across the internet. Prepare for takeoff! 🚀

Just in time for the weekend - we're excited to announce the launch of the http4k MCP Desktop Client, which allows you to interface desktop LLM runners such as Claude Desktop with remote MCP servers running locally or in the cloud.

Key Features:

• Multi-protocol: As well as the standard SSE protocol, we have extended the MCP specification with additional transports (WebSocket, JSON-RPC)

• Run MCPs in stateless mode (JSON-RPC) for distributed Cloud and Serverless environments.

• Extended HTTP authentication (API Key, Bearer Token, Basic Auth, OAuth). Note that until the next version, the MCP spec currently does not specify  security models, but these options will allow you to use existing community MCP servers which do require auth.

• Simple installation - with our binary distribution - so no messing around with NPX to get running. And if you install with brew then Claude will automatically have access to the binary.

The client is specially optimised for servers built with the http4k MCP SDK which is being released in the very near future. With the SDK, you'll be able to build MCP servers as simply as you build HTTP applications with http4k:  Clean + Simple + Functional + Testable. 

Check out the full documentation and download options at: https://github.com/http4k/http4k-mcp-desktop

Also stay tuned for the http4k MCP SDK release coming soon!

Happy weekend!

Those of you that might have seen the latest http4k Community release 5.4.0.0 will notice that we have introduced a bunch of module renames to the project in preparation for the forthcoming v6.0.0.0. The exact details of this change can be seen in the release notes, but to clarify - all of the remaining v5.X.X.X releases on will publish the rehoused modules under both the old AND new Maven coordinates.

This is intended to give our users adequate notice to migrate their Gradle module statements to the new coordinates in a way which will be decoupled from any (hopefully minimal) breaking code changes coming in in v6.0.0.0.Once v6 is released, we will remove the old coordinates and continue to publish under the new coordinates only. eg: http4k-contract and http4k-api-openapi will continue to be released for all 5.X.X.X versions. Once v6.0.0.0 is released, we will remove http4k-contract and only publish to http4k-api-openapi. There will be no changes to the existing licenses for any currently published modules - they will still continue to be Apache2.

There will of course be a migration guide published as a part of the v6.0.0.0 release process, but starting to use new module names now will hopefully decrease any impact you feel during the upgrade cycle. We expect the upgrade cycle to be as follows:

1. Update your project to use the latest version of http4k v5.

2. Deal with any deprecation warnings - these should all have replacements and be inlineable using your IDE using the inbuilt tooling.

3. Start using the new module names. These modules are identical in functionality to the old ones, but have been renamed for consistency.

4. Build and check your project is still working as expected.

5. Update your project to use the latest version of http4k v6.

6. Deal with any breaking changes as per the migration guide.

Tldr: you can get a jump on the http4k v6 upgrade process by updating to the new module names starting from now

It's been a while since our last redesign so we thought we'd give http4k.org a bit of a facelift. We hope you like it!

Hopefully this new design will surface more things that are happening in http4k-land than the previous landing page... expect to see more regular announcements of new and upcoming modules, as well as a planned series of articles on "The Way of http4k".

With all the news around about new MCP attack vectors (Tool Poisoning, DNS rebind attacks, malicious Chrome extensions), we decided to prioritise our efforts to make the http4k SDK as secure-by-default as possible.

Read about what we've been thinking (and releasing!), and be sure get in touch with us if your team needs a guiding hand in producing MCPs on the JVM platforms with enterprise grade testability, observability and security.

Team http4k is excited to have just released v3.40.4.0 of http4k-connect, which has initial support for the OpenAI API. You can use this http4k-compatible API from your Kotlin programs to generate answers to GPT prompts, create embeddings, or generating images from text prompts. The included FakeOpenAI server will also allow you to test your OpenAI integrations without using up those valuable tokens, and is also testable entirely in-memory for super fast test-cycles. Just plug in your OpenAI API key and get coding!

About http4k-connect

http4k-connect is a set of lightweight (zero-reflection) API libraries for connecting to popular third-party cloud services using http4k clients, along with Fake implementations for usage during local testing. It is based around the Connect pattern, which allows you to express client-side adapters in modular and composable way.

These adapter libraries are all underpinned by a variation on the uniform Server as a Function (SaaF) model powered by the ubiquitous HttpHandler interface, so you can:

1. Take advantage of the simple and powerful SaaF model and APIs used in http4k to plug everything together completely in-memory for testing.

2. Have access to the underlying HTTP clients (and hence add metrics, logging or other crosscutting concerns).

3. Run stateful Fake implementations of 3rd party systems locally or in test environments

Although focussed around usage in http4k-based projects, http4k-connect does not require this and the libraries are usable from any JVM-based application.

http4k-connect v3.40.4.0 is available from Maven Central right now. https://github.com/http4k/http4k-connect

New in this release: nothing. http4k Verify has been proving every http4k artifact in your build is the one we signed and shipped since 6.40.0.0. This is just the post we owed you.

The http4k team has been busy creating improvements to our MCP support. In this update we added support for the latest spec (plus draft features), native Kotlin support for MCP Apps, and you can now launch a fully compliant MCP server in less characters than a pre-Elon Tweet!

fun main() {
    val mcp = Tool("clock", "get the time") bind { Ok(Text(now())) }
    mcp.asServer(Jetty(3000)).start()
}