diff --git a/mcp/worker.js b/mcp/worker.js
index ca0d103..f607639 100644
--- a/mcp/worker.js
+++ b/mcp/worker.js
@@ -139,7 +139,8 @@ export default {
     const url = new URL(req.url);
     if (req.method === "OPTIONS") return new Response(null, { headers: CORS });
     if (url.pathname === "/health") return new Response("ok gandora-mcp 0.0.2 inference=" + (env.INFERENCE ? "bound" : "missing"), { headers: CORS });
-    if (url.pathname !== "/mcp") return new Response("gandora mcp spike: POST /mcp", { status: 404, headers: CORS });
+    const want = env.TOKEN ? "/mcp/" + env.TOKEN : "/mcp";
+    if (url.pathname !== want) return new Response("gandora mcp spike", { status: 404, headers: CORS });
     if (req.method !== "POST") return new Response(null, { status: 405, headers: CORS });
     let body;
     try { body = await req.json(); } catch { return Response.json({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } }, { status: 400, headers: CORS }); }