From ff6e9146cf3d46f8a38bdc812f38b2bf53de316a Mon Sep 17 00:00:00 2001 From: teahubxyz Date: Thu, 22 Oct 2026 19:26:11 +0000 Subject: [PATCH] mcp: gate the endpoint behind a secret path (/mcp/) now that it can spend render quota Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_014mBuCaQSgWwqhtzsmTBQuM --- mcp/worker.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mcp/worker.js b/mcp/worker.js index ca0d103..f607639 100644 --- a/mcp/worker.js +++ b/mcp/worker.js @@ -139,7 +139,8 @@ export default { const url = new URL(req.url); if (req.method === "OPTIONS") return new Response(null, { headers: CORS }); if (url.pathname === "/health") return new Response("ok gandora-mcp 0.0.2 inference=" + (env.INFERENCE ? "bound" : "missing"), { headers: CORS }); - if (url.pathname !== "/mcp") return new Response("gandora mcp spike: POST /mcp", { status: 404, headers: CORS }); + const want = env.TOKEN ? "/mcp/" + env.TOKEN : "/mcp"; + if (url.pathname !== want) return new Response("gandora mcp spike", { status: 404, headers: CORS }); if (req.method !== "POST") return new Response(null, { status: 405, headers: CORS }); let body; try { body = await req.json(); } catch { return Response.json({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } }, { status: 400, headers: CORS }); }