fix(mcp): forward Symfony HTTP exception messages as JSON-RPC errors

[alexisLefebvre]

Q	A
Branch?	4.3
Bug fix?	yes
New feature?	no
Deprecations?	no
Issues	-
License	MIT
Doc PR	-

What

The MCP handler converts a caller-facing HTTP exception from a state provider or processor into a JSON-RPC error carrying its message — but only API Platform's HttpExceptionInterface qualified. Symfony's HttpKernel\Exception\HttpExceptionInterface declares the same methods and is a distinct interface, so it fell through to the SDK's generic handler, which substitutes Internal server error..

Both interfaces now qualify. Every other throwable still reaches the generic handler, so arbitrary exception text is not leaked.

Why

Throwing NotFoundHttpException from a provider is the documented way to signal a missing resource. api-platform/metadata ships no 404 exception implementing its own interface — AccessDeniedException is the only class that does. So two caller-facing failures in one provider behaved differently by package of origin.

#[ApiResource(
    mcp: [
        'set_order_delivery_info' => new McpTool(
            provider: SetOrderDeliveryInfoProvider::class,
            processor: SetOrderDeliveryInfoProcessor::class,
        ),
    ],
)]
final class Order { /* ... */ }

use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

final readonly class SetOrderDeliveryInfoProvider implements ProviderInterface
{
    public function provide(Operation $operation, array $uriVariables = [], array $context = []): Order
    {
        $order = $this->orderRepository->find($context['mcp_data']['orderId'] ?? null);
        if (null === $order) {
            throw new NotFoundHttpException('Order not found.');
        }

        return $order;
    }
}

A tools/call with an unknown orderId:

// before
{"jsonrpc": "2.0", "id": 2, "error": {"code": -32603, "message": "Internal server error."}}
// after
{"jsonrpc": "2.0", "id": 2, "error": {"code": -32603, "message": "Order not found."}}

Otherwise an application must declare an exception extending Symfony's and implementing API Platform's interface, purely to get the message through. Only observable with mcp/sdk 0.8, which sanitises what its generic handler catches.

🤖 Generated with Claude Code