When using an MCP sync server, in a servlet environment, use SyncSpecification#immediateExecution(true), introduced in modelcontextprotocol/java-sdk#371 .

This allows to propagate thread-locals to the @Tool method; granting access to e.g. Framework's RequestContextHolder#getRequestAttributes() or Security's SecurityContextHolder#getContext().

This, in turn, allows users to use Spring Security's method-level security, e.g.:

@PreAuthorize("hasScope('widget.read')")
@Tool(description = "...")
public Widget getWidget(...) {
    // ...
}

@PreAuthorize("hasScope('widget.admin')")
@Tool(description = "...")
public Widget addWidget(...) {
    // ...
}