A method, cloud hosting system, and device for dynamic access to multi-tenant resources based on the MCP protocol

Abstract

This invention relates to the field of multi-tenant cloud service technology and discloses a multi-tenant resource dynamic access method, cloud hosting system, and apparatus based on the MCP protocol, including: a client system, an intelligent agent system, an MCP routing service system, and an MCP service group system; the client system is used to initiate service requests to the intelligent agent system, receive the endpoint address and short token returned by the MCP routing service system, and establish and maintain an SSE long connection with the MCP service; the intelligent agent system is used to determine whether the service request needs to call an MCP tool, initiate an MCP tool call request through the SSE long connection, and process the returned result; the MCP routing service system serves as a central scheduling component. This invention uses tenant group dynamic routing, directing each tenant's MCP tool call to a dedicated endpoint, avoiding the mixing of tool interfaces from different tenants. GPT-4o testing verified that the MCP tool identification accuracy is improved from 60% in the prior art to over 90%, an improvement of 30%.

Description

Technical Field

[0001] This invention relates to the field of multi-tenant cloud service technology, specifically to a multi-tenant resource dynamic access method, cloud hosting system, and device based on the MCP protocol. Background Technology

[0002] In existing technologies, with the large-scale deployment of AI agent systems, expanding the capability boundaries of agent systems by calling external tools (such as database queries and API interfaces) has become a mainstream application model. The MCP protocol, as a standardized interface for interaction between large models and external tools, can significantly improve the efficiency and compatibility of tool calls in agent systems and is widely used in multi-tenant cloud hosting platforms.

[0003] Traditional solutions employ centralized MCP servers, where all tenants share the same set of tool interfaces, lacking dynamic routing capabilities. In high-concurrency scenarios, mixed tenant requests can easily lead to tool identification errors, and excessive load on a single endpoint can cause response latency, making tenant-level resource quota management impossible. Using long tokens (such as JWT strings) for interface authentication requires each request to carry the complete token. This token not only consumes large model context window resources (especially in large models billed by token, increasing computational costs), but also increases network latency due to repeated transmissions. Adding new tenants requires manual configuration of interface policies and resource quotas, making it impossible to dynamically adjust service deployment based on tenant scale. Response time to tenant expansion requests typically exceeds one second, making it difficult to adapt to large-scale tenant scenarios.

[0004] In existing technologies, the basic MCP architecture proposed by Anthropic uses a centralized server endpoint, and multiple tenants distinguish their identities through API keys. Although it achieves basic tool invocation functionality, the aforementioned resource contention, token redundancy, and scalability issues remain unresolved. When the number of tenants exceeds 1000 or concurrent requests exceed 1000 QPS, the accuracy of tool invocation drops below 60%, and token consumption increases by 80%. Therefore, we propose a multi-tenant resource dynamic access method, cloud-hosted system, and device based on the MCP protocol. Summary of the Invention

[0005] The purpose of this invention is to provide a method, cloud hosting system, and device for dynamic access to multi-tenant resources based on the MCP protocol, so as to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for dynamic access to multi-tenant resources based on the MCP protocol, comprising the following steps:

[0007] S1. The client system initiates a service request to the agent system. When the agent system determines that the MCP tool needs to be called, it triggers the client system's authentication and route acquisition process.

[0008] S2. The client system carries an authentication long token and sends an endpoint address and short token acquisition request to the MCP routing service system.

[0009] S3. After verifying the legality of the authentication long token, the MCP routing service system matches the MCP service endpoint address corresponding to the tenant to which the client system belongs based on the preset tenant grouping strategy, and generates a short token with time expiration.

[0010] S4. The MCP routing service system returns the MCP service endpoint address and short token to the client system;

[0011] S5. The client system establishes an SSE long connection with the corresponding MCP service based on the MCP service endpoint address;

[0012] S6. The intelligent agent system sends an MCP tool call request to the MCP service through the SSE long connection, and the request carries the short token.

[0013] S7. After receiving the request, the MCP service sends a long token exchange request to the MCP routing service system with the short token.

[0014] S8. After verifying the validity of the short token, the MCP routing service system returns the corresponding authentication long token to the MCP service.

[0015] S9. The MCP service, carrying the authentication long token, initiates a tool call request to the multi-tenant platform system.

[0016] S10. After verifying the authentication long token, the multi-tenant platform system executes the tool call operation and returns the result to the MCP service. The MCP service sends the result back to the intelligent agent system through the SSE long connection. The intelligent agent system processes the result and presents it to the client system.

[0017] Optionally, the tenant grouping strategy in S3 includes: the MCP routing service system maintains the mapping relationship between tenant IDs and MCP service endpoint addresses, monitors the load status of each MCP service endpoint in real time, and automatically migrates some tenants under the target endpoint to an idle endpoint and updates the mapping relationship when the load of the target endpoint exceeds a preset threshold.

[0018] Optionally, the short token in S3 is generated in the following way: the MCP routing service system extracts the tenant identifier and validity period information from the authentication long token, encrypts the key information using a Hash algorithm or MD5 algorithm, and generates a temporary credential with a length of 16-32 bits. The validity period of the short token is set to 5-30 minutes.

[0019] Optionally, after the SSE long connection is established as described in S5, the MCP service allocates an independent data stream channel for each tenant's SSE connection, and achieves multi-tenant data stream isolation through channel identifiers.

[0020] This invention also proposes a multi-tenant resource dynamic access cloud hosting system based on the MCP protocol, comprising: a client system, an intelligent agent system, an MCP routing service system, and an MCP service group system;

[0021] The client system initiates service requests to the agent system, receives endpoint addresses and short tokens returned by the MCP routing service system, and establishes and maintains an SSE long connection with the MCP service. The agent system determines whether the service request requires calling the MCP tool, initiates an MCP tool call request through the SSE long connection, and processes the returned results. The MCP routing service system, as a central scheduling component, verifies the authentication long token, maintains the mapping relationship between tenants and MCP service endpoints, generates short tokens, and implements load-aware dynamic routing. The MCP service group system contains multiple MCP service endpoints deployed in tenant groups. Each endpoint receives MCP tool call requests from the corresponding tenant and interacts with the multi-tenant platform system. The multi-tenant platform system performs tenant authentication based on the authentication long token, provides underlying resource support for MCP tool calls, executes tool call operations, and returns results.

[0022] Optionally, the MCP routing service system includes: a token processing module, a routing scheduling module, and a policy management module;

[0023] The token processing module is used to verify the validity of the long authentication token, generate a short token, and exchange the short token for the corresponding long authentication token; the routing scheduling module is used to maintain the tenant-endpoint mapping table, monitor the CPU utilization, memory usage and request queue length of each MCP service endpoint, and trigger tenant migration when the load exceeds the preset threshold; the policy management module is used to store and update tenant grouping policies, load thresholds and token validity parameters.

[0024] Optionally, each MCP service endpoint in the MCP service group system includes: a connection management module, a request forwarding module, and a result return module;

[0025] The connection management module is used to establish a long SSE connection with the client system, maintain the connection status, and realize the isolation of multi-tenant data flow channels; the request forwarding module is used to receive the MCP tool call request from the agent system, carry the short token to exchange for a long token from the MCP routing service system, and forward the tool call request to the multi-tenant platform system; the result feedback module is used to receive the tool call result returned by the multi-tenant platform system and send it back to the agent system through the SSE long connection.

[0026] The present invention also proposes a multi-tenant resource dynamic access device based on the MCP protocol, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the above method.

[0027] Compared with existing technologies, the present invention provides a method, cloud hosting system and device for dynamic access to multi-tenant resources based on the MCP protocol, which has the following beneficial effects:

[0028] 1. The multi-tenant resource dynamic access method, cloud hosting system and device based on the MCP protocol, through tenant group dynamic routing, directs the MCP tool call of each tenant to a dedicated endpoint, avoiding the mixing of tool interfaces of different tenants. According to GPT-4o test verification, the MCP tool identification accuracy is improved from 60% of the existing technology to more than 90%, an improvement of 30%.

[0029] 2. The multi-tenant resource dynamic access method, cloud hosting system and device based on the MCP protocol adopts short tokens instead of long tokens for transmission. The length of the short token is only 1 / 5 to 1 / 3 of that of the long token, which significantly reduces the authentication data occupation of the large model context window and reduces the overall token usage by 50%. In large model scenarios where billing is based on tokens, it can reduce the computational cost by nearly half.

[0030] 3. The multi-tenant resource dynamic access method, cloud hosting system and device based on the MCP protocol automatically allocates idle endpoints when a new tenant is added, without the need for manual configuration, and the response time is <100ms; at the same time, through load-aware routing, tenants with high-load endpoints are migrated to idle nodes, ensuring that the load of each endpoint is kept below 70%, and the system's concurrent processing capability is improved by 2 times.

[0031] 4. This multi-tenant resource dynamic access method, cloud hosting system and device based on the MCP protocol achieves tenant-level data isolation and authentication security through the independent data stream channel of the SSE long connection and the timeliness verification of the short token, avoiding data leakage between tenants. At the same time, the short token does not contain complete user information, so even if it is leaked, it cannot directly obtain tenant permissions, thus significantly improving security. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the process of the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] like Figure 1 As shown, the present invention provides a technical solution: a method for dynamic access to multi-tenant resources based on the MCP protocol, comprising the following steps:

[0035] S1. When the client system initiates a service request to the agent system, and the agent system determines that the MCP tool needs to be called, it triggers the client system's authentication and route acquisition process.

[0036] S2. The client system carries the authentication long token and sends an endpoint address and short token acquisition request to the MCP routing service system.

[0037] After verifying the legitimacy of the long authentication token, the S3 and MCP routing service systems, based on a preset tenant grouping strategy, match the MCP service endpoint address corresponding to the tenant of the client system and generate a short token with a time limit. The tenant grouping strategy includes: the MCP routing service system maintaining a mapping relationship between tenant IDs and MCP service endpoint addresses, monitoring the load status of each MCP service endpoint in real time, and automatically migrating some tenants under that endpoint to an idle endpoint and updating the mapping relationship when the load of a target endpoint exceeds a preset threshold. The short token is generated as follows: the MCP routing service system extracts the tenant identifier and validity information from the long authentication token, encrypts the key information using a Hash algorithm or MD5 algorithm, and generates a temporary credential with a length of 16-32 bits. The validity period of the short token is set to 5-30 minutes.

[0038] S4, the MCP routing service system returns the MCP service endpoint address and short token to the client system;

[0039] S5. The client system establishes an SSE long connection with the corresponding MCP service based on the MCP service endpoint address. After the SSE long connection is established, the MCP service allocates an independent data stream channel for each tenant's SSE connection and achieves multi-tenant data stream isolation through channel identifier.

[0040] S6. The intelligent agent system sends an MCP tool call request to the MCP service through an SSE long connection, with the request carrying a short token.

[0041] After receiving the request, the S7 and MCP services send a long token exchange request to the MCP routing service system, carrying the short token.

[0042] After verifying the validity of the short token, the S8 and MCP routing service systems return the corresponding authentication long token to the MCP service.

[0043] The S9 and MCP services carry a long authentication token and initiate a tool call request to the multi-tenant platform system.

[0044] After the S10 multi-tenant platform system verifies and authenticates the long token, it executes the tool call operation and returns the result to the MCP service. The MCP service then sends the result back to the agent system via the SSE long connection. The agent system processes the result and presents it to the client system.

[0045] This embodiment also proposes a multi-tenant resource dynamic access cloud hosting system based on the MCP protocol, characterized in that it includes: a client system, an intelligent agent system, an MCP routing service system, an MCP service group system, and a multi-tenant platform system;

[0046] The client system initiates service requests to the agent system, receives endpoint addresses and short tokens returned by the MCP routing service system, and establishes and maintains an SSE long connection with the MCP service. The agent system determines whether the service request requires calling the MCP tool, initiates an MCP tool call request through the SSE long connection, and processes the returned results. The MCP routing service system, as a central scheduling component, verifies the authentication long token, maintains the mapping relationship between tenants and MCP service endpoints, generates short tokens, and implements load-aware dynamic routing. The MCP service group system contains multiple MCP service endpoints deployed in tenant groups. Each endpoint receives MCP tool call requests from the corresponding tenant and interacts with the multi-tenant platform system. The multi-tenant platform system performs tenant authentication based on the authentication long token, provides underlying resource support for MCP tool calls, executes tool call operations, and returns results.

[0047] It is worth noting that the MCP routing service system includes: a token processing module, a route scheduling module, and a policy management module;

[0048] The token processing module is used to verify the validity of the long authentication token, generate a short token, and exchange the short token for the corresponding long authentication token; the routing scheduling module is used to maintain the tenant-endpoint mapping table, monitor the CPU utilization, memory usage and request queue length of each MCP service endpoint, and trigger tenant migration when the load exceeds the preset threshold; the policy management module is used to store and update tenant grouping policies, load thresholds and token validity parameters.

[0049] Each MCP service endpoint in the MCP service group system includes: a connection management module, a request forwarding module, and a result return module;

[0050] The connection management module is used to establish a long SSE connection with the client system, maintain the connection status, and realize the isolation of multi-tenant data flow channels; the request forwarding module is used to receive the MCP tool call request from the agent system, carry the short token to exchange for a long token from the MCP routing service system, and forward the tool call request to the multi-tenant platform system; the result feedback module is used to receive the tool call result returned by the multi-tenant platform system and send it back to the agent system through the SSE long connection.

[0051] As one application of this embodiment: This embodiment uses tenant group dynamic routing, and each tenant's MCP tool call is directed to a dedicated endpoint, avoiding the mixing of tool interfaces of different tenants. As verified by GPT-4o testing, the MCP tool recognition accuracy is improved from 60% in the prior art to more than 90%, an improvement of 30%.

[0052] The present invention has been described in detail above. However, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, any modifications or improvements that do not depart from the spirit of the present invention are within the scope of protection of the present invention.

Claims

1. A method for dynamic access to multi-tenant resources based on the MCP protocol, characterized in that, Includes the following steps: S1. The client system initiates a service request to the agent system. When the agent system determines that the MCP tool needs to be called, it triggers the client system's authentication and route acquisition process. S2. The client system carries an authentication long token and sends an endpoint address and short token acquisition request to the MCP routing service system. S3. After verifying the legality of the authentication long token, the MCP routing service system matches the MCP service endpoint address corresponding to the tenant to which the client system belongs based on the preset tenant grouping strategy, and generates a short token with time expiration. S4. The MCP routing service system returns the MCP service endpoint address and short token to the client system; S5. The client system establishes an SSE long connection with the corresponding MCP service based on the MCP service endpoint address; S6. The intelligent agent system sends an MCP tool call request to the MCP service through the SSE long connection, and the request carries the short token. S7. After receiving the request, the MCP service sends a long token exchange request to the MCP routing service system with the short token. S8. After verifying the validity of the short token, the MCP routing service system returns the corresponding authentication long token to the MCP service. S9. The MCP service, carrying the authentication long token, initiates a tool call request to the multi-tenant platform system. S10. After verifying the authentication long token, the multi-tenant platform system executes the tool call operation and returns the result to the MCP service. The MCP service sends the result back to the intelligent agent system through the SSE long connection. The intelligent agent system processes the result and presents it to the client system.

2. The method for dynamic access to multi-tenant resources based on the MCP protocol according to claim 1, characterized in that, The tenant grouping strategy described in S3 includes: the MCP routing service system maintains the mapping relationship between tenant IDs and MCP service endpoint addresses, monitors the load status of each MCP service endpoint in real time, and automatically migrates some tenants under the target endpoint to an idle endpoint and updates the mapping relationship when the load of the target endpoint exceeds a preset threshold.

3. The method for dynamic access to multi-tenant resources based on the MCP protocol according to claim 1, characterized in that, The short token mentioned in S3 is generated in the following way: the MCP routing service system extracts the tenant identifier and validity period information from the authentication long token, encrypts the key information using a Hash algorithm or MD5 algorithm, and generates a temporary credential with a length of 16-32 bits. The validity period of the short token is set to 5-30 minutes.

4. The method for dynamic access to multi-tenant resources based on the MCP protocol according to claim 1, characterized in that, After the SSE long connection described in S5 is established, the MCP service allocates an independent data stream channel for each tenant's SSE connection, and achieves multi-tenant data stream isolation through channel identifier.

5. A multi-tenant resource dynamic access cloud hosting system based on the MCP protocol, wherein the system is applied to the method described in any one of claims 1-4, characterized in that, include: The client system is used to initiate service requests to the intelligent agent system, receive the endpoint address and short token returned by the MCP routing service system, and establish and maintain an SSE long connection with the MCP service. The intelligent agent system is used to determine whether a service request requires calling the MCP tool, initiates the MCP tool call request through an SSE long connection, and processes the returned result. The MCP routing service system, as a central scheduling component, is used to verify authentication long tokens, maintain the mapping relationship between tenants and MCP service endpoints, generate short tokens, and implement load-aware dynamic routing. The MCP service group system includes multiple MCP service endpoints deployed in groups by tenant. Each endpoint is used to receive MCP tool call requests from the corresponding tenant and interact with the multi-tenant platform system. The multi-tenant platform system is used for tenant authentication based on authentication long tokens, provides underlying resource support for MCP tool calls, executes tool call operations, and returns results.

6. The multi-tenant resource dynamic access cloud hosting system based on the MCP protocol according to claim 5, characterized in that, The MCP routing service system includes: The token processing module is used to verify the validity of the authentication long token, generate a short token, and exchange the short token for the corresponding authentication long token. The routing and scheduling module is used to maintain the tenant-endpoint mapping table, monitor the CPU utilization, memory usage and request queue length of each MCP service endpoint, and trigger tenant migration when the load exceeds the preset threshold. The policy management module is used to store and update tenant grouping policies, load thresholds, and token validity parameters.

7. The multi-tenant resource dynamic access cloud hosting system based on the MCP protocol according to claim 5, characterized in that, Each MCP service endpoint in the MCP service group system includes: The connection management module is used to establish SSE long connections with client systems, maintain connection status, and achieve isolation of multi-tenant data flow channels. The request forwarding module is used to receive the MCP tool call request from the intelligent agent system, carry the short token to exchange for a long token from the MCP routing service system, and forward the tool call request to the multi-tenant platform system. The result feedback module is used to receive the tool call results returned by the multi-tenant platform system and send them back to the agent system via an SSE long connection.

8. A multi-tenant resource dynamic access device based on the MCP protocol, characterized in that, It includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method according to any one of claims 1-4.

Images