From f49850d23bbbe7b173d372cdab6be84e7836cf1e Mon Sep 17 00:00:00 2001
From: Mathias Bergqvist <mthbqv@gmail.com>
Date: Mon, 4 May 2026 13:57:14 +0200
Subject: [PATCH] chore(mcp): require bearer token for supervisor MCP

The pod now enforces SUPERVISOR_MCP_TOKEN; this matches the .mcp.json
header so a Claude Code session in this repo authenticates correctly.
Token comes from the operator's shell env, not the repo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .mcp.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.mcp.json b/.mcp.json
index 032827d..eec8ffe 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -2,7 +2,10 @@
   "mcpServers": {
     "supervisor": {
       "type": "http",
-      "url": "http://koala:30320/mcp"
+      "url": "http://koala:30320/mcp",
+      "headers": {
+        "Authorization": "Bearer ${SUPERVISOR_MCP_TOKEN}"
+      }
     },
     "brain": {
       "type": "http",