Before: _validate_http_bind warned about MCP_AUTH_TOKEN being required for
remote HTTP but the token was never passed to the FastMCP constructor, so the
server accepted any request without authentication.
After: a StaticTokenVerifier is built at module load if MCP_AUTH_TOKEN is set
and passed as auth= to FastMCP(). Loopback-only deployments (no token set)
continue to work as anonymous mode.
7 new tests in tests/test_http_auth.py covering: token present/absent, mcp
instance wiring, loopback/remote bind guard, remote-without-token rejection.
233 tests total.
Umutcan Edizsalan
00e14423df