Multi-tenant resource dynamic access method based on MCP protocol, cloud hosting system and device

Abstract

The invention relates to the technical field of multi-tenant cloud services, and discloses a multi-tenant resource dynamic access method based on an MCP protocol, and a cloud hosting system and device, and the system comprises a client system, an intelligent agent system, an MCP routing service system, and an MCP service group system. The client system is used for initiating a service request to the agent system, receiving an endpoint address and a short token returned by the MCP routing service system, and establishing and maintaining SSE long connection with the MCP service; the agent system is used for judging whether the service request needs to call the MCP tool or not, initiating an MCP tool call request through SSE long connection, and processing a returned result; the MCP routing service system serves as a central scheduling component, the MCP tool calling of each tenant is directed to an exclusive endpoint through tenant grouping dynamic routing, tool interface mixing of different tenants is avoided, and the MCP tool recognition accuracy is improved to 90% or above from 60% in the prior art and is improved by 30% through GPT-4o test verification.

Description

Technical Field

[0001] This invention relates to the field of multi-tenant cloud service technology, specifically to a multi-tenant resource dynamic access method, cloud hosting system, and device based on the MCP protocol. Background Technology

[0002] In existing technologies, with the large-scale deployment of AI agent systems, expanding the capability boundaries of agent systems by calling external tools (such as database queries and API interfaces) has become a mainstream application model. The MCP protocol, as a standardized interface for interaction between large models and external tools, can significantly improve the efficiency and compatibility of tool calls in agent systems and is widely used in multi-tenant cloud hosting platforms.

[0003] Traditional solutions employ centralized MCP servers, where all tenants share the same set of tool interfaces, lacking dynamic routing capabilities. In high-concurrency scenarios, mixed tenant requests can easily lead to tool identification errors, and excessive load on a single endpoint can cause response latency, making tenant-level resource quota management impossible. Using long tokens (such as JWT strings) for interface authentication requires each request to carry the complete token. This token not only consumes large model context window resources (especially in large models billed by token, increasing computational costs), but also increases network latency due to repeated transmissions. Adding new tenants requires manual configuration of interface policies and resource quotas, making it impossible to dynamically adjust service deployment based on tenant scale. Response time to tenant expansion requests typically exceeds one second, making it difficult to adapt to large-scale tenant scenarios.

[0004] In existing technologies, the basic MCP architecture proposed by Anthropic uses a centralized server endpoint, and multiple tenants distinguish their identities through API keys. Although it achieves basic tool invocation functionality, the aforementioned resource contention, token redundancy, and scalability issues remain unresolved. When the number of tenants exceeds 1000 or concurrent requests exceed 1000 QPS, the accuracy of tool invocation drops below 60%, and token consumption increases by 80%. Therefore, we propose a multi-tenant resource dynamic access method, cloud-hosted system, and device based on the MCP protocol. Summary of the Invention

[0005] The purpose of this invention is to provide a method, cloud hosting system, and device for dynamic access to multi-tenant resources based on the MCP protocol, so as to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for dynamic access to multi-tenant resources based on the MCP protocol, comprising the following steps:

[0007] S1. The client system initiates a service request to the agent system. When the agent system determines that the MCP tool needs to be called, it triggers the client system's authentication and route acquisition process.

[0008] S2. The client system carries an authentication long token and sends an endpoint address and short token acquisition request to the MCP routing service system.

[0009] S3. After verifying the legality of the authentication long token, the MCP routing service system matches the MCP service endpoint address corresponding to the tenant to which the client system belongs based on the preset tenant grouping strategy, and generates a short token with time expiration.

[0010] S4. The MCP routing service system returns the MCP service endpoint address and short token to the client system;

[0011] S5. The client system establishes an SSE long connection with the corresponding MCP service based on the MCP service endpoint address;

[0012] S6. The intelligent agent system sends an MCP tool call request to the MCP service through the SSE long connection, and the request carries the short token.

[0013] S7. After receiving the request, the MCP service sends a long token exchange request to the MCP routing service system with the short token.

[0014] S8. After verifying the validity of the short token, the MCP routing service system returns the corresponding authentication long token to the MCP service.

[0015] S9. The MCP service, carrying the authentication long token, initiates a tool call request to the multi-tenant platform system.

[0016] S10. After verifying the authentication long token, the multi-tenant platform system executes the tool call operation and returns the result to the MCP service. The MCP service sends the result back to the intelligent agent system through the SSE long connection. The intelligent agent system processes the result and presents it to the client system.

[0017] Optionally, the tenant grouping strategy in S3 includes: the MCP routing service system maintains the mapping relationship between tenant IDs and MCP service endpoint addresses, monitors the load status of each MCP service endpoint in real time, and automatically migrates some tenants under the target endpoint to an idle endpoint and updates the mapping relationship when the load of the target endpoint exceeds a preset threshold.

[0018] Optionally, the short token in S3 is generated in the following way: the MCP routing service system extracts the tenant identifier and validity period information from the authentication long token, encrypts the key information using a Hash algorithm or MD5 algorithm, and generates a temporary credential with a length of 16-32 bits. The validity period of the short token is set to 5-30 minutes.

[0019] Optionally, after the SSE long connection is established as described in S5, the MCP service allocates an independent data stream channel for each tenant's SSE connection, and achieves multi-tenant data stream isolation through channel identifiers.

[0020] This invention also proposes a multi-tenant resource dynamic access cloud hosting system based on the MCP protocol, comprising: a client system, an intelligent agent system, an MCP routing service system, and an MCP service group system;

[0021] The client system initiates service requests to the agent system, receives endpoint addresses and short tokens returned by the MCP routing service system, and establishes and maintains an SSE long connection with the MCP service. The agent system determines whether the service request requires calling the MCP tool, initiates an MCP tool call request through the SSE long connection, and processes the returned results. The MCP routing service system, as a central scheduling component, verifies the authentication long token, maintains the mapping relationship between tenants and MCP service endpoints, generates short tokens, and implements load-aware dynamic routing. The MCP service group system contains multiple MCP service endpoints deployed in tenant groups. Each endpoint receives MCP tool call requests from the corresponding tenant and interacts with the multi-tenant platform system. The multi-tenant platform system performs tenant authentication based on the authentication long token, provides underlying resource support for MCP tool calls, executes tool call operations, and returns results.

[0022] Optionally, the MCP routing service system includes: a token processing module, a routing scheduling module, and a policy management module;

[0023] The token processing module is used to verify the validity of the long authentication token, generate a short token, and exchange the short token for the corresponding long authentication token; the routing scheduling module is used to maintain the tenant-endpoint mapping table, monitor the CPU utilization, memory usage and request queue length of each MCP service endpoint, and trigger tenant migration when the load exceeds the preset threshold; the policy management module is used to store and update tenant grouping policies, load thresholds and token validity parameters.

[0024] Optionally, each MCP service endpoint in the MCP service group system includes: a connection management module, a request forwarding module, and a result return module;

[0025] The connection management module is used to establish a long SSE connection with the client system, maintain the connection status, and realize the isolation of multi-tenant data flow channels; the request forwarding module is used to receive the MCP tool call request from the agent system, carry the short token to exchange for a long token from the MCP routing service system, and forward the tool call request to the multi-tenant platform system; the result feedback module is used to receive the tool call result returned by the multi-tenant platform system and send it back to the agent system through the SSE long connection.

[0026] The present invention also proposes a multi-tenant resource dynamic access device based on the MCP protocol, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the above method.

[0027] Compared with existing technologies, the present invention provides a method, cloud hosting system and device for dynamic access to multi-tenant resources based on the MCP protocol, which has the following beneficial effects:

[0028] 1. The multi-tenant resource dynamic access method, cloud hosting system and device based on the MCP protocol, through tenant group dynamic routing, directs the MCP tool call of each tenant to a dedicated endpoint, avoiding the mixing of tool interfaces of different tenants. According to GPT-4o test verification, the MCP tool identification accuracy is improved from 60% of the existing technology to more than 90%, an improvement of 30%.

[0029] 2. The multi-tenant resource dynamic access method, cloud hosting system and device based on the MCP protocol adopts short tokens instead of long tokens for transmission. The length of the short token is only 1 / 5 to 1 / 3 of that of the long token, which significantly reduces the authentication data occupation of the large model context window and reduces the overall token usage by 50%. In large model scenarios where billing is based on tokens, it can reduce the computational cost by nearly half.

[0030] 3. The multi-tenant resource dynamic access method, cloud hosting system and device based on the MCP protocol automatically allocates idle endpoints when a new tenant is added, without the need for manual configuration, and the response time is <100ms; at the same time, through load-aware routing, tenants with high-load endpoints are migrated to idle nodes, ensuring that the load of each endpoint is kept below 70%, and the system's concurrent processing capability is improved by 2 times.

[0031] 4. This multi-tenant resource dynamic access method, cloud hosting system and device based on the MCP protocol achieves tenant-level data isolation and authentication security through the independent data stream channel of the SSE long connection and the timeliness verification of the short token, avoiding data leakage between tenants. At the same time, the short token does not contain complete user information, so even if it is leaked, it cannot directly obtain tenant permissions, thus significantly improving security. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the process of the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] like Figure 1 As shown, the present invention provides a technical solution: a method for dynamic access to multi-tenant resources based on the MCP protocol, comprising the following steps:

[0035] S1. When the client system initiates a service request to the agent system, and the agent system determines that the MCP tool needs to be called, it triggers the client system's authentication and route acquisition process.

[0036] S2. The client system carries the authentication long token and sends an endpoint address and short token acquisition request to the MCP routing service system.

[0037] After verifying the legitimacy of the long authentication token, the S3 and MCP routing service systems, based on a preset tenant grouping strategy, match the MCP service endpoint address corresponding to the tenant of the client system and generate a short token with a time limit. The tenant grouping strategy includes: the MCP routing service system maintaining a mapping relationship between tenant IDs and MCP service endpoint addresses, monitoring the load status of each MCP service endpoint in real time, and automatically migrating some tenants under that endpoint to an idle endpoint and updating the mapping relationship when the load of a target endpoint exceeds a preset threshold. The short token is generated as follows: the MCP routing service system extracts the tenant identifier and validity information from the long authentication token, encrypts the key information using a Hash algorithm or MD5 algorithm, and generates a temporary credential with a length of 16-32 bits. The validity period of the short token is set to 5-30 minutes.

[0038] S4, the MCP routing service system returns the MCP service endpoint address and short token to the client system;

[0039] S5. The client system establishes an SSE long connection with the corresponding MCP service based on the MCP service endpoint address. After the SSE long connection is established, the MCP service allocates an independent data stream channel for each tenant's SSE connection and achieves multi-tenant data stream isolation through channel identifier.

[0040] S6. The intelligent agent system sends an MCP tool call request to the MCP service through an SSE long connection, carrying a short token in the request.

[0041] After receiving the request, the S7 and MCP services send a long token exchange request to the MCP routing service system, carrying the short token.

[0042] After verifying the validity of the short token, the S8 and MCP routing service systems return the corresponding authentication long token to the MCP service.

[0043] The S9 and MCP services carry a long authentication token and initiate a tool call request to the multi-tenant platform system.

[0044] After the S10 multi-tenant platform system verifies and authenticates the long token, it executes the tool call operation and returns the result to the MCP service. The MCP service then sends the result back to the agent system via the SSE long connection. The agent system processes the result and presents it to the client system.

[0045] This embodiment also proposes a multi-tenant resource dynamic access cloud hosting system based on the MCP protocol, characterized in that it includes: a client system, an intelligent agent system, an MCP routing service system, an MCP service group system, and a multi-tenant platform system;

[0046] The client system initiates service requests to the agent system, receives endpoint addresses and short tokens returned by the MCP routing service system, and establishes and maintains an SSE long connection with the MCP service. The agent system determines whether the service request requires calling the MCP tool, initiates an MCP tool call request through the SSE long connection, and processes the returned results. The MCP routing service system, as a central scheduling component, verifies the authentication long token, maintains the mapping relationship between tenants and MCP service endpoints, generates short tokens, and implements load-aware dynamic routing. The MCP service group system contains multiple MCP service endpoints deployed in tenant groups. Each endpoint receives MCP tool call requests from the corresponding tenant and interacts with the multi-tenant platform system. The multi-tenant platform system performs tenant authentication based on the authentication long token, provides underlying resource support for MCP tool calls, executes tool call operations, and returns results.

[0047] It is worth noting that the MCP routing service system includes: a token processing module, a route scheduling module, and a policy management module;

[0048] The token processing module is used to verify the validity of the long authentication token, generate a short token, and exchange the short token for the corresponding long authentication token; the routing scheduling module is used to maintain the tenant-endpoint mapping table, monitor the CPU utilization, memory usage and request queue length of each MCP service endpoint, and trigger tenant migration when the load exceeds the preset threshold; the policy management module is used to store and update tenant grouping policies, load thresholds and token validity parameters.

[0049] Each MCP service endpoint in the MCP service group system includes: a connection management module, a request forwarding module, and a result return module;

[0050] The connection management module is used to establish a long SSE connection with the client system, maintain the connection status, and realize the isolation of multi-tenant data flow channels; the request forwarding module is used to receive the MCP tool call request from the agent system, carry the short token to exchange for a long token from the MCP routing service system, and forward the tool call request to the multi-tenant platform system; the result feedback module is used to receive the tool call result returned by the multi-tenant platform system and send it back to the agent system through the SSE long connection.

[0051] As one application of this embodiment: This embodiment uses tenant group dynamic routing, and each tenant's MCP tool call is directed to a dedicated endpoint, avoiding the mixing of tool interfaces of different tenants. As verified by GPT-4o testing, the MCP tool recognition accuracy is improved from 60% in the prior art to more than 90%, an improvement of 30%.

[0052] The present invention has been described in detail above. However, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, any modifications or improvements that do not depart from the spirit of the present invention are within the scope of protection of the present invention.

Claims

1. A method for dynamic access of multi-tenant resources based on MCP protocol, characterized in that, The method comprises the following steps: S1, the client system initiates a service request to the agent system, and the agent system judges whether to call the MCP tool, triggers the authentication and routing acquisition process of the client system; S2, the client system carries the authentication long token, and sends an endpoint address and a short token acquisition request to the MCP routing service system; S3, the MCP routing service system verifies the legality of the authentication long token, matches the MCP service endpoint address corresponding to the tenant to which the client system belongs based on the preset tenant grouping strategy, and generates a short token with time limit; S4, the MCP routing service system returns the MCP service endpoint address and the short token to the client system; S5, the client system establishes an SSE long connection with the corresponding MCP service according to the MCP service endpoint address; S6, the agent system sends an MCP tool calling request to the MCP service through the SSE long connection, and the request carries the short token; S7, the MCP service receives the request, carries the short token, and initiates a long token exchange request to the MCP routing service system; S8, the MCP routing service system verifies the validity of the short token and returns the corresponding authentication long token to the MCP service; S9, the MCP service carries the authentication long token and initiates a tool calling request to the multi-tenant platform system; S10, the multi-tenant platform system verifies the authentication long token, executes the tool calling operation and returns the result to the MCP service, the MCP service returns the result to the agent system through the SSE long connection, and the agent system presents the result to the client system after processing the result.

2. The method of claim 1, wherein, The tenant grouping strategy in S3 comprises: the MCP routing service system maintains the mapping relationship between tenant ID and MCP service endpoint address, and monitors the load state of each MCP service endpoint in real time. When the load of the target endpoint exceeds the preset threshold, part of the tenants under the endpoint are automatically migrated to the idle endpoint, and the mapping relationship is updated.

3. The method of claim 1, wherein, The short token in S3 is generated by the following method: the MCP routing service system extracts the tenant identifier and validity period information in the authentication long token, encrypts the key information by using Hash algorithm or MD5 algorithm, generates a temporary credential with a length of 16-32 bits, and the validity period of the short token is set to 5-30 minutes.

4. The method of claim 1, wherein, After the establishment of the SSE long connection in S5, the MCP service allocates an independent data flow channel for the SSE connection of each tenant, and realizes the isolation of multi-tenant data flow through the channel identifier.

5. A multi-tenant resource dynamic access cloud hosting system based on MCP protocol, characterized in that, The method comprises: A client system for initiating a service request to an agent system, receiving an endpoint address and a short token returned by an MCP routing service system, and establishing and maintaining an SSE long connection with an MCP service; An agent system for judging whether a service request needs to call an MCP tool, initiating an MCP tool calling request through an SSE long connection, and processing a returned result; An MCP routing service system as a central dispatching component for verifying an authentication long token, maintaining a mapping relationship between a tenant and an MCP service endpoint, generating a short token, and realizing a load-aware dynamic routing. The MCP service group system comprises a plurality of MCP service endpoints deployed in groups according to tenants, each of which is used to receive an MCP tool invocation request of a corresponding tenant and interact with a multi-tenant platform system; The multi-tenant platform system is used to perform tenant authentication based on an authentication long token, provide underlying resource support for an MCP tool invocation, execute a tool invocation operation and return a result.

6. The multi-tenant resource dynamic access cloud hosting system based on MCP protocol according to claim 5, wherein, The MCP routing service system comprises: A token processing module is configured to verify the legality of an authentication long token, generate a short token, and exchange the corresponding authentication long token according to the short token; A routing scheduling module is configured to maintain a tenant-endpoint mapping table, monitor the CPU utilization, memory occupancy and request queue length of each MCP service endpoint, and trigger tenant migration when the load exceeds a preset threshold; A policy management module is configured to store and update tenant grouping policies, load threshold values and token validity period parameters.

7. The multi-tenant resource dynamic access cloud hosting system based on MCP protocol according to claim 5, wherein, Each MCP service endpoint in the MCP service group system comprises: A connection management module is configured to establish an SSE long connection with a client system, maintain a connection state, and realize multi-tenant data flow channel isolation; A request forwarding module is configured to receive an MCP tool invocation request of an agent system, exchange a long token with the MCP routing service system by carrying a short token, and forward the tool invocation request to the multi-tenant platform system; A result return module is configured to receive a tool invocation result returned by the multi-tenant platform system and return the tool invocation result to the agent system through the SSE long connection.

8. A multi-tenant resource dynamic access device based on a MCP protocol, characterized in that, A memory and a processor are included, the memory stores a computer program, and the processor implements the steps of the method in any one of claims 1-4 when executing the computer program.

Images