Spring AI, LangChain4j, Quarkus, and Helidon all now speak the Model Context Protocol. That is a bigger shift than another integration library, because for the first time it points Java frameworks at a role they have never had to play before: being called by an AI model, not the other way around.
For most of the last two years, “Java and AI” meant one direction of travel. A Spring Boot service called out to an LLM, got a completion back, and moved on. MCP flips part of that relationship. Instead of only consuming a model, the JVM can now sit on the other side of the wire as a tool server, and an agent decides when to call it. That is the part of the story that year-in-review pieces are starting to call “Java became AI infrastructure,” and it deserves a closer look than a single sentence.
Four Frameworks, One Protocol, Different Angles
Spring AI 2.0 shipped in June 2026 with the annotation layer, previously an incubating community project, folded into core. A Spring bean method annotated with @McpTool is enough to register a callable tool, and the framework generates the JSON schema for it automatically. Quarkus’s MCP server extension takes a similar declarative path through CDI beans, and had stdio support running as early as January 2025, months before most competing ecosystems had anything shipped. Helidon joined later, in August 2025, as a separate extension project rather than a core module, and leans on its LangChain4j integration for the client side. LangChain4j itself remains the framework most teams reach for when the goal is consuming external MCP servers rather than exposing internal ones, and both Quarkus and Helidon build their client tooling on top of it rather than reinventing it.
| Framework | Primary role | Transports | Built-in auth path |
|---|---|---|---|
| Spring AI | Server and client | Stdio, Streamable HTTP, SSE (deprecated) | OAuth 2.0 / API key via the mcp-security module |
| Quarkus | Server and client | Stdio, HTTP (Streamable), WebSocket | Quarkus Security CDI, plus a dedicated OIDC extension |
| Helidon | Server, client via LangChain4j | Server transport per helidon-mcp docs | Configuration-level, project-specific |
| LangChain4j | Client-first | Stdio, HTTP | Depends on the host framework wrapping it |
None of this required Java developers to learn a new mental model. Tools look like ordinary service methods, resources look like ordinary URI-addressable data, and the framework handles the JSON-RPC plumbing underneath. That ease is exactly why adoption moved fast, and exactly why the security conversation lagged behind it.
The Direction Nobody Planned Defenses For
Consuming an MCP server is a controlled decision: your application chooses which servers to trust and what to send them. Exposing one flips that control. Once a Spring Boot service registers @McpTool methods and binds them to an HTTP endpoint, any client that can reach that endpoint can ask the model to invoke your business logic on its behalf. The protocol was designed with local, trusted-network usage in mind, and its specification does not require authentication or authorization by default according to Cloud Security Alliance research published in May 2026. That gap between a permissive spec and a production deployment is where most of this year’s incidents have come from.
The Numbers Behind the Risk Conversation
Multiple independent research teams scanned the MCP ecosystem through 2026, and their numbers, despite different sample sizes and methods, tell a consistent story.
| Vulnerability class | Reported prevalence | Source |
|---|---|---|
| Path traversal in file operations | 82% | Endor Labs, 2,614 implementations scanned |
| Command injection | 43% | Equixly offensive-security assessment, 2025âFeb 2026 |
| Server-side request forgery | 36.7% | BlueRock Security, 7,000+ servers scanned |
| Any critical vulnerability | 33% | Enkrypt AI, 1,000 servers scanned, October 2025 |
| No authentication at all | ~38â40% | Wiz Research and two independent corroborating scans |
The unauthenticated figure is the one that matters most for a Java shop, because it is entirely a deployment choice rather than a protocol flaw. Wiz’s research also found that MCP now shows up in roughly 80% of the cloud environments it scanned, with about one in six of those exposing at least one server publicly. Put a Spring Boot MCP server behind a load balancer without an auth filter, and you have built exactly the kind of endpoint these scans keep finding.
The Growth Curve Is Not Slowing Down
Internet-wide scans through the first half of 2026 show the exposed surface expanding rather than shrinking as adoption accelerates faster than hardening.
Trend Micro’s own February-to-April tracking found the count of exposed servers nearly tripling in that window, and Censys watched its own count nearly double again in the space of eight days in late April and early May. Neither team scanned the same population the same way, so treat the two lines as two separate trend signals rather than one unified count, but both point the same direction.
What This Actually Means for a Spring Boot Team
The good news is that the Java ecosystem is not standing still on the defensive side. Spring AI’s mcp-security project adds OAuth 2.0 authorization, dynamic client registration, and scope step-up for both MCP servers and clients, though it currently only covers WebMVC-based servers for the full authentication story; WebFlux servers are limited to origin validation for now. Quarkus shipped a dedicated quarkus-mcp-server-oidc extension that returns spec-compliant “insufficient scope” challenges when a protected endpoint rejects a request, which matters because it gives the calling agent a machine-readable reason rather than a silent failure. Both of these are recent additions, arriving well after the frameworks’ first MCP releases, which is itself a sign of how the security layer trailed the feature layer.
Observability has fared better from day one. Spring AI’s MCP integration produces Micrometer spans and OpenTelemetry-compatible traces out of the box, and Quarkus exposes similar metrics through its Micrometer integration. That means a team exposing tools today can usually see who called what and how often without extra wiring, even if locking down who is allowed to call still takes deliberate configuration.
A working checklist before you expose a Spring Boot service as an MCP tool server
- Put authentication in front of the endpoint before it goes anywhere near a public network. An open Streamable HTTP endpoint is a request handler with no login screen.
- Treat tool descriptions and resource content returned by any third-party MCP server you consume as untrusted input, since they enter the model’s context with instruction-level weight.
- Avoid exposing stdio-based servers to network-reachable processes; the transport was built for local, trusted execution and several 2026 CVEs trace directly back to that assumption being violated.
- Turn on the tracing your framework already gives you, and actually look at it. Micrometer spans are only useful if something reviews the tool-call pattern for anomalies.
- Audit which MCP dependencies your build pulls in transitively, the same way you would audit any other supply chain dependency.
Where This Leaves the JVM
Java did not become AI infrastructure because of a marketing decision. It became AI infrastructure because Spring Boot, Quarkus, and Helidon already run a huge share of the enterprise services that agents now want to call, and MCP gave those services a standard door to be called through. That is a genuine capability gain. It is also, for now, a door that ships unlocked by default, and the frameworks’ security modules are still catching up to the pace at which teams are installing the annotation and shipping to production.
What We Learned
Spring AI, Quarkus, Helidon, and LangChain4j have each made it genuinely easy to turn a Java service into an MCP tool or resource server, mostly through a handful of annotations and auto-configuration. That ease is real progress, but it has outpaced the authentication and authorization story: independent 2026 scans converge on roughly 38 to 40 percent of MCP servers running with no authentication at all, and the population of publicly exposed servers has kept growing through the year rather than shrinking. The frameworks’ own security modules, like Spring AI’s mcp-security and Quarkus’s OIDC extension, close a real gap, but they arrived after the feature set did, which means the responsibility for locking down a newly exposed tool surface still sits with the team that builds it, not with the defaults it ships with.
