From 2e05105bb0aab526f952450d232bcfdb110c878b Mon Sep 17 00:00:00 2001
From: Jamie Brunton <jamie@jbrunton.co.uk>
Date: Sat, 10 Jan 2026 19:55:37 +0000
Subject: [PATCH] Use StreamableHTTP transport for MCP server

---
 apps/mcp/src/index.ts    | 10 +++-------
 apps/mcp/src/lib/auth.ts | 10 +++++++---
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/apps/mcp/src/index.ts b/apps/mcp/src/index.ts
index 5c30aad..700acb0 100644
--- a/apps/mcp/src/index.ts
+++ b/apps/mcp/src/index.ts
@@ -8,19 +8,15 @@ const app = new Hono();
 
 app.use('*', logger());
 app.use('/mcp', authMiddleware);
+app.use('/mcp/*', authMiddleware);
 
 app.get('/health', (c) => c.json({ status: 'ok', service: 'sauci-mcp' }));
 
-// Initialize MCP server
+// Initialize MCP server with StreamableHTTP transport
 const mcpServer = createMcpServer();
 
-// Mount MCP server
+// StreamableHTTP endpoint - handles all MCP communication
 app.all('/mcp', async (c) => {
-  // Add headers to prevent Nginx/proxy buffering for SSE
-  c.header('X-Accel-Buffering', 'no');
-  c.header('Cache-Control', 'no-cache');
-  c.header('Connection', 'keep-alive');
-  
   return mcpServer.handleRequest(c);
 });
 
diff --git a/apps/mcp/src/lib/auth.ts b/apps/mcp/src/lib/auth.ts
index 5fbea51..153c294 100644
--- a/apps/mcp/src/lib/auth.ts
+++ b/apps/mcp/src/lib/auth.ts
@@ -11,11 +11,15 @@ export const authMiddleware = async (c: Context, next: Next) => {
     return next();
   }
 
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    return c.json({ error: 'Unauthorized: Missing or invalid Authorization header' }, 401);
+  let token = c.req.header('Authorization')?.replace('Bearer ', '');
+  
+  if (!token) {
+    token = c.req.query('apiKey');
   }
 
-  const token = authHeader.replace('Bearer ', '');
+  if (!token) {
+    return c.json({ error: 'Unauthorized: Missing or invalid Authorization header or apiKey query param' }, 401);
+  }
 
   if (token !== apiKey) {
     return c.json({ error: 'Unauthorized: Invalid API key' }, 401);