From 6e175b7da4888ee1350576fde5e453015a3ddd3f Mon Sep 17 00:00:00 2001
From: Graham Barber <green.cheese8030@fastmail.com>
Date: Thu, 13 Nov 2025 17:21:56 +0000
Subject: [PATCH] feat(mcp): pull bearer token from environment variables

---
 packages/mcp/hono.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/packages/mcp/hono.ts b/packages/mcp/hono.ts
index 5094ad7..378eb9e 100644
--- a/packages/mcp/hono.ts
+++ b/packages/mcp/hono.ts
@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import { cors } from "hono/cors";
+import { bearerAuth } from "hono/bearer-auth";
 import { createConsumer } from "@cistern/consumer";
 import { getLogger, withContext } from "@logtape/logtape";
 import { toFetchResponse, toReqRes } from "fetch-to-node";
@@ -12,6 +13,14 @@ export function createApp() {
   const logger = getLogger(["cistern", "http"]);
   const sessions = new Map<string, StreamableHTTPServerTransport>();
 
+  const token = Deno.env.get("CISTERN_MCP_BEARER_TOKEN");
+
+  if (!token) {
+    logger.error("http mode requires CISTERN_MCP_BEARER_TOKEN to be set");
+    return Deno.exit(1);
+  }
+
+  app.use("*", bearerAuth({ token }));
   app.use("*", async (c, next) => {
     const requestId = crypto.randomUUID();
     const startTime = Date.now();
-- 
2.51.2