Optional bearer-token auth for the MCP HTTP transport (self-host)

[ahmetvural79]

The open-core MCP Streamable HTTP transport is unauthenticated by design (meant to sit behind your own proxy). For self-hosters who expose it directly, add an opt-in static bearer token check (VITRUS_MCP_TOKEN).

Scope

• VITRUS_MCP_TOKEN env; if set, require Authorization: Bearer on the HTTP transport
• 401 with a clear message when missing/wrong
• document in docs/MCP.md (stdio unaffected)