feat(mcp): add optional bearer-token auth

[corylanou]

Description

Adds optional bearer-token authentication to the MCP Streamable HTTP transport on top of #1378.

• Adds the top-level mcp-auth-token configuration setting, including existing YAML environment expansion support.
• Wraps only the official SDK Streamable HTTP handler with bearer authentication.
• Returns 401 Unauthorized and WWW-Authenticate: Bearer for missing or incorrect credentials when configured.
• Preserves the current open HTTP behavior when the token is unset.
• Leaves transport-neutral MCP middleware, and therefore stdio behavior, unchanged.

Example configuration:

mcp-addr: "127.0.0.1:3001"
mcp-auth-token: ${LITESTREAM_MCP_AUTH_TOKEN}

Motivation and Context

Before this change, NewMCP registered the official SDK HTTP handler directly on the server mux, and Config had no MCP authentication setting. Anyone able to reach mcp-addr could access tools including the mutating restore and reset operations.

Configuration/request	Before	After
Token unset	Open	Open
Correct bearer token	Open	200 OK
Missing or incorrect token	Open	401 Unauthorized

The token is a defense-in-depth option. SSH tunneling, an authenticated TLS reverse proxy, VPN, or private networking remain the primary controls for the MCP endpoint. Bearer tokens should not be sent over an untrusted plaintext connection.

Scope

In scope:

• Optional static bearer authentication for Streamable HTTP.
• Configuration and environment expansion wiring.
• HTTP authorization behavior tests.

Not in scope:

• Authentication changes to stdio.
• OAuth or token rotation.
• Changes from sibling MCP branches.

How Has This Been Tested?

go test -race -run '^TestMCPServerBearerAuth$' -v ./cmd/litestream/
go test -race -run '^TestReadConfigFile$/^ExpandEnv$' -v ./cmd/litestream/
go test -race ./cmd/litestream/
go vet ./...
pre-commit run --all-files
go test -race ./...
go build -o /tmp/litestream-issue-1374 ./cmd/litestream
go mod verify

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project (go fmt, go vet)
• I have tested my changes (go test ./...)
• I have documented the configuration and retained the primary reverse-proxy/SSH guidance above

Related

• Stacked on refactor(mcp): migrate to the official modelcontextprotocol/go-sdk #1378
• Closes feat(mcp): optional bearer-token auth for the HTTP transport #1374

[github-actions]

PR Build Metrics

✅ All clear — no issues detected

Check	Status	Summary
Binary size	✅	38.29 MB (+4.0 KB / +0.01%)
Dependencies	✅	No changes
Vulnerabilities	✅	None detected
Go toolchain	✅	1.25.12 (latest)
Module graph	✅	1248 edges (0)

Binary Size

	Size	Change
Base (eb6c415)	38.29 MB
PR (c69d866)	38.29 MB	+4.0 KB (+0.01%)

Dependency Changes

No dependency changes.

govulncheck Output

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.
Use '-show verbose' for more details.

Build Info

Metric	Value
Build time	51s
Go version	go1.25.12
Commit	c69d866

History (3 previous)

Commit	Updated	Status	Summary
7e3f02c	2026-07-18 22:16 UTC	✅	38.27 MB (0.0 KB / 0.00%)
8a19215	2026-07-17 19:50 UTC	✅	38.27 MB (0.0 KB / 0.00%)
088a753	2026-07-17 19:32 UTC	✅	38.27 MB (0.0 KB / 0.00%)

---

_{🤖 Updated on each push.}