fix: security hardening and health check for v2.0.1

- Add GET /health endpoint (no auth) for Docker/K8s probes
- Fix audit bypass: notification-style requests now always logged
- Fix CORS default: disabled by default, warn on startup if unset
- Fix /health method restriction: GET/HEAD only, 405 otherwise
- Fix Docker HEALTHCHECK: /sse (401 with auth) -> /health
- Update docs to prefer MCP_AUTH_TOKENS=name:token,... format
- Update K8s probes in docs to use /health

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: MimoJanra

CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.1] - 2026-06-01 - Security & Health Check Fixes
+
+### Added
+- `GET /health` — unauthenticated liveness probe endpoint; returns `200 ok`. Used by Docker `HEALTHCHECK`, Kubernetes liveness/readiness probes, and uptime monitors. Does not expose any server state.
+
+### Fixed
+- **Audit log bypass** — notification-style JSON-RPC requests (no `id` field) were silently skipped by the audit middleware. A client could send `tools/call` without an `id` and the tool would execute without being logged. All requests are now audited regardless of notification status; notification entries get `status: "notification"`.
+- **Docker `HEALTHCHECK`** — was calling unauthenticated `GET /sse`, which returns `401` when `MCP_AUTH_TOKENS` is configured. Now calls `GET /health`.
+- **CORS wildcard default** — `CORS_ALLOWED_ORIGIN` now defaults to `""` (disabled) instead of `"*"`. Operators must explicitly set the origin. A startup INFO log explains the setting and suggests `https://claude.ai` for browser-based access. Claude Desktop and CLI tools (mcp-remote) are unaffected — they do not enforce browser CORS policy.
+- **`/health` method restriction** — previously accepted any HTTP method and returned `200`. Now only `GET` and `HEAD` are accepted; other methods return `405 Method Not Allowed`.
+
+### Changed
+- All documentation updated to prefer `MCP_AUTH_TOKENS=name:token,...` over the legacy `MCP_AUTH_TOKEN` single-token variable in shared server examples.
+- Kubernetes liveness/readiness probes in docs updated to use `/health` instead of `/sse` or `/messages`.
+
 ## [2.0.0] - 2026-05-31 - MCP Protocol Improvements
 
 ### Added

README.md

@@ -185,7 +185,8 @@ cat > .env << EOF
 ALLURE_BASE_URL=https://your-testops.com
 PORT=3000
 LOG_LEVEL=INFO
-MCP_AUTH_TOKEN=generate-random-string-here
+# Preferred for teams: name:token pairs (each user gets their own token)
+MCP_AUTH_TOKENS=artem:$(openssl rand -hex 16),ivan:$(openssl rand -hex 16)
 EOF
 ```
 
@@ -406,7 +407,7 @@ Or deploy with:
 - Default mode for Claude Desktop
 
 ### Team Shared Server (HTTP Mode)
-**Always set `MCP_AUTH_TOKEN` in production:**
+**Always set `MCP_AUTH_TOKENS` in production:**
 - Use HTTPS (or ngrok) to encrypt credentials
 - Set concrete CORS origin (not `*`)
 - Place behind reverse proxy (nginx, Caddy)

cmd/server/main.go

@@ -78,6 +78,9 @@ func runHTTP(mcpServer *mcp.Server, cfg *config.Config, logger *core.Logger) {
 	if len(cfg.Users) == 0 {
 		logger.Warn("no auth tokens configured (MCP_AUTH_TOKENS / MCP_AUTH_TOKEN) — server accepts unauthenticated requests", nil)
 	}
+	if cfg.CORSAllowOrigin == "" {
+		logger.Info("CORS not configured — fine for Claude Desktop and CLI tools; set CORS_ALLOWED_ORIGIN=https://claude.ai if connecting via a web browser", nil)
+	}
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("/health", mcpServer.HandleHealth)

docs/API.md

@@ -501,7 +501,7 @@ data: {"jsonrpc":"2.0","id":1,"result":{"content":[...]}}
 ```
 
 **Headers:**
-- `Authorization: Bearer <MCP_AUTH_TOKEN>` (if `MCP_AUTH_TOKEN` is set)
+- `Authorization: Bearer <your-token>` — required when `MCP_AUTH_TOKENS` is configured on the server
 
 ---
 
@@ -539,7 +539,7 @@ Content-Length: 0
 The actual response is delivered to the SSE stream.
 
 **Headers:**
-- `Authorization: Bearer <MCP_AUTH_TOKEN>` (if required)
+- `Authorization: Bearer <your-token>` — required when `MCP_AUTH_TOKENS` is configured on the server
 - `Content-Type: application/json`
 
 ---
@@ -760,7 +760,7 @@ asyncio.run(main())
 | `200` | OK (SSE stream opened) | GET /sse |
 | `202` | Accepted (request queued) | POST /messages |
 | `400` | Bad Request | Missing sessionId, invalid JSON |
-| `401` | Unauthorized | Missing/invalid `MCP_AUTH_TOKEN` |
+| `401` | Unauthorized | Missing or invalid bearer token |
 | `404` | Not Found | Unknown sessionId |
 | `500` | Server Error | Crash, internal bug |
 

docs/INSTALLATION.md

@@ -126,7 +126,7 @@ Run the container:
 docker run \
   -e ALLURE_BASE_URL=https://your-allure.com \
   -e ALLURE_TOKEN=your_token_here \
-  -e MCP_AUTH_TOKEN=your_shared_secret \
+  -e MCP_AUTH_TOKENS=alice:token-for-alice,bob:token-for-bob \
   -e LOG_LEVEL=INFO \
   -p 3000:3000 \
   allure-mcp
@@ -213,11 +213,11 @@ spec:
             secretKeyRef:
               name: allure-secrets
               key: token
-        - name: MCP_AUTH_TOKEN
+        - name: MCP_AUTH_TOKENS
           valueFrom:
             secretKeyRef:
               name: mcp-secrets
-              key: auth-token
+              key: auth-tokens
         livenessProbe:
           httpGet:
             path: /health

docs/QUICKSTART.md

@@ -58,12 +58,12 @@ docker build -t allure-mcp .
 docker run -d \
   -e ALLURE_BASE_URL=https://your-allure.com \
   -e ALLURE_TOKEN=your_token_here \
-  -e MCP_AUTH_TOKEN=your_shared_secret \
+  -e MCP_AUTH_TOKENS=alice:token-for-alice,bob:token-for-bob \
   -p 3000:3000 \
   allure-mcp --http
 
-# 3. Test
-curl -H "Authorization: Bearer your_shared_secret" \
+# 3. Test (use any configured user's token)
+curl -H "Authorization: Bearer token-for-alice" \
      http://localhost:3000/sse
 
 ```

docs/SECURITY.md

@@ -23,27 +23,30 @@ Security considerations and best practices for Allure MCP Server.
 
 ### HTTP Mode (Team/Server)
 
-**Always set `MCP_AUTH_TOKEN` in production.**
+**Always set `MCP_AUTH_TOKENS` in production** (preferred for teams — each user gets their own named token):
 
 ```bash
-# Generate a strong random token
-openssl rand -base64 32
+# Generate a strong random token per user
+openssl rand -hex 32
 
-# Export to .env
-MCP_AUTH_TOKEN=your_generated_token_here
+# Set in .env — format: name:token,name:token,...
+MCP_AUTH_TOKENS=artem:token1,ivan:token2,qa:token3
 ```
 
-Clients must include the token:
+Each client authenticates with their own token:
 
 ```bash
-curl -H "Authorization: Bearer $MCP_AUTH_TOKEN" http://localhost:3000/sse
+curl -H "Authorization: Bearer $MY_TOKEN" http://localhost:3000/sse
 ```
 
-The token is checked on:
-- `GET /sse` — SSE stream endpoint
-- `POST /messages` — Message submission endpoint
+The token is checked on every authenticated endpoint (`/sse`, `/messages`, `/mcp`). `/health` is exempt.
+
+**Legacy single-token mode** (backward-compatible, treated as user `"default"`):
+```bash
+MCP_AUTH_TOKEN=your_generated_token_here
+```
 
-**Note:** Token is case-sensitive and checked with Bearer scheme.
+**Note:** Tokens are case-sensitive and checked with the Bearer scheme.
 
 ---
 
@@ -238,7 +241,7 @@ type: Opaque
 stringData:
   ALLURE_BASE_URL: https://allure.example.com
   ALLURE_TOKEN: your_token_here
-  MCP_AUTH_TOKEN: your_mcp_secret
+  MCP_AUTH_TOKENS: alice:token1,bob:token2
 ```
 
 Mount in pod:
@@ -261,13 +264,13 @@ env:
 3. Restart server with new token
 4. Revoke old token in Allure UI
 
-**MCP Auth Token:**
+**MCP Auth Tokens:**
 
-1. Generate new token: `openssl rand -base64 32`
-2. Update `MCP_AUTH_TOKEN` in `.env` or secret manager
+1. Generate new token for the user: `openssl rand -hex 32`
+2. Update `MCP_AUTH_TOKENS` in `.env` or secret manager (replace only that user's entry)
 3. Restart server
-4. Notify team of new token
-5. Clients must update their config
+4. Notify the affected user of their new token
+5. Other users' tokens remain valid — no team-wide disruption
 
 ---
 
@@ -361,9 +364,9 @@ Send logs to centralized system:
 ### Before Production Deployment
 
 - [ ] **Authentication**
-  - [ ] `MCP_AUTH_TOKEN` is set to strong random value
-  - [ ] Token is stored in secret manager (Vault, AWS Secrets Manager, etc.)
-  - [ ] Token rotated monthly
+  - [ ] `MCP_AUTH_TOKENS` is set with strong per-user tokens
+  - [ ] Tokens are stored in secret manager (Vault, AWS Secrets Manager, etc.)
+  - [ ] Tokens rotated periodically per user
 
 - [ ] **Network**
   - [ ] HTTPS/TLS enabled

internal/config/config.go

@@ -15,7 +15,7 @@ const (
 	maxTimeoutSec             = 600
 	defaultPort               = ":3000"
 	defaultLogLevel           = "INFO"
-	defaultCORSOrigin         = "*"
+	defaultCORSOrigin         = "" // disabled by default; set CORS_ALLOWED_ORIGIN explicitly in production
 	defaultAuditRetentionDays = 30
 	defaultAuditLogPath       = "audit"
 )

internal/config/config_test.go

@@ -58,7 +58,7 @@ func TestLoad_Defaults(t *testing.T) {
 	if cfg.LogLevel != "INFO" {
 		t.Errorf("default log level = %q", cfg.LogLevel)
 	}
-	if cfg.CORSAllowOrigin != "*" {
+	if cfg.CORSAllowOrigin != "" {
 		t.Errorf("default CORS = %q", cfg.CORSAllowOrigin)
 	}
 }

internal/mcp/middleware.go

@@ -47,13 +47,18 @@ func panicRecoveryMiddleware(logger *core.Logger) middlewareFunc {
 func auditMiddleware(auditLog *audit.Logger) middlewareFunc {
 	return func(next requestHandler) requestHandler {
 		return func(ctx context.Context, req *JSONRPCRequest) *JSONRPCResponse {
-			if auditLog == nil || req.IsNotification() {
+			if auditLog == nil {
 				return next(ctx, req)
 			}
+			// Always audit, even notification-style requests (id=null), so that
+			// omitting the id field cannot be used to silently skip the audit log.
 			start := time.Now()
+			isNotif := req.IsNotification()
 			resp := next(ctx, req)
 			status := "ok"
-			if resp != nil && resp.Error != nil {
+			if isNotif {
+				status = "notification"
+			} else if resp != nil && resp.Error != nil {
 				status = "error"
 			}
 			entry := audit.Entry{
@@ -73,6 +78,9 @@ func auditMiddleware(auditLog *audit.Logger) middlewareFunc {
 				}
 			}
 			auditLog.Write(entry)
+			if isNotif {
+				return nil
+			}
 			return resp
 		}
 	}