---
id: w2/m1/t003
title: Auth + transport — reuse bex-api-token, stdio + streamable-http
worker: worker2
status: done
estimate: 25m
depends_on: [w2/m1/t001]
---

## Objective

Make the MCP server usable both locally (stdio) and in-cluster (HTTP), authed by the existing bearer token — fail closed with no token, exactly like bex-api.

## Context

- bex-api requires `Authorization: Bearer <token>` (constant-time compare) on every route except `/healthz`; token from Secret `bex-system/bex-api-token`, binary refuses to start without it (`docs/ADR006-bex-api.md`).
- MCP clients connect over stdio (local agents) or streamable-http (remote); reuse the same token check for the HTTP transport.

## Steps

1. Support two transports: stdio and streamable-http (flag-selected).
2. On the HTTP transport, require `Bearer` matching `bex-api-token` (constant-time); open `/healthz` only.
3. Refuse to start if the token is unset (fail closed).

## Files

- `operator/cmd/mcp/main.go` · reuse the bex-api auth middleware

## Acceptance criteria

- [ ] stdio mode works tokenless for a local agent; HTTP mode rejects a missing/bad bearer with 401 and starts only when the token Secret is present.

## Out of scope

- Per-tenant tokens / multi-tenant auth (arrives with the control plane, w1/m2).
