fix(security): resolve RUSTSEC-2026-0204 and consolidate safe dep bumps

Upgrade crossbeam-epoch to 0.9.20 and spin to 0.9.9 so cargo audit is clean
on main. Apply compatible Dependabot lockfile bumps in one change and fix the
clippy lint that was failing Lint on those PRs. Also ship MCP admin_token
HTTP enforcement, query-arg forwarding, and protocol-mcp project templates.

Author: Tuntii

CHANGELOG.md

@@ -9,11 +9,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **MCP HTTP admin token enforcement**: when `McpConfig::admin_token` is set, the sidecar rejects unauthenticated JSON-RPC with `401` (`Authorization: Bearer`, `X-MCP-Token`, or `?token=`).
+- **MCP query-parameter tool args**: remaining non-path arguments on safe methods are forwarded as a query string (proxy + in-process URI).
+- **`cargo rustapi mcp generate --admin-token`** (env: `RUSTAPI_MCP_TOKEN`).
+- **`cargo rustapi new`**: `protocol-mcp` feature option; `ai-api` preset includes it; minimal template wires `McpServer` + `RUSTAPI_MCP_TOKEN` when selected.
 - **`docs/GOLDEN_PATH.md`** — canonical handler → OpenAPI → probes → MCP/deploy walkthrough; linked from README, docs hub, cookbook SUMMARY, Getting Started.
 - **`golden_path` example** uses route macros + tags so `/docs/openapi.json` includes `/api/v1/ping` (not only `.route()` wiring).
 
 ### Changed
 
+- **Dependabot consolidation**: lockfile bumps for `open` 5.4.0, `toml` 1.1.3, `uuid` 1.23.5, `http-body-util` 0.1.4, `bytes` 1.12.1, `simd-json` 0.17.3, `regex` 1.13.0, `rustls` 0.23.42, `redis` 1.4.0 (supersedes open Dependabot PRs #228–#236; skips major `rand` 0.8→0.10).
 - **Production Readiness v0.2** ([#200](https://github.com/Tuntii/RustAPI/issues/200)): coverage CI publishes HTML + Cobertura artifacts with job summary; release-drafter publishes drafts on `v*` tags; README links [Production Checklist](docs/PRODUCTION_CHECKLIST.md) in the header.
 - README Quick Start: golden path first; document OpenAPI at `/docs/openapi.json`; prefer macros for OpenAPI registration; `tracing-subscriber` + `production_defaults` in the hello snippet.
 - Dependency updates: `actions/checkout@v7`, `actions/cache@v6`, `brotli` 8, `rcgen` 0.14, `tera` 2, `thiserror` 2, OpenTelemetry 0.32 stack, `sqlx` 0.9, `tracing-opentelemetry` 0.33.
@@ -24,6 +29,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Security Audit**: upgrade transitive `crossbeam-epoch` 0.9.18 → 0.9.20 (`RUSTSEC-2026-0204`); un-yank `spin` 0.9.8 → 0.9.9.
+- **Clippy** (`-D warnings`): remove redundant borrow in `rustapi-core` validation message formatting (was failing Lint on Dependabot PRs).
 - **`rcgen` 0.14 HTTP/3 dev certs**: `generate_self_signed_cert` uses `CertifiedKey { cert, signing_key }` so `--all-features` / `http3-dev` builds pass CI again.
 - **SQLx 0.9 jobs + CRUD generator**: Postgres job backend uses `AssertSqlSafe` and `Json` payloads; `cargo rustapi generate crud` emits SQLx 0.9-compatible SQLite handlers.
 - **Security Audit** (`cargo audit`) passes on the current lockfile (no high-severity `quick-xml` advisories).

Cargo.lock

@@ -59,6 +59,14 @@ pub struct McpGenerateArgs {
     /// MCP over standard input/output.
     #[arg(long)]
     pub stdio: bool,
+
+    /// Require this token on the HTTP MCP transport
+    /// (`Authorization: Bearer`, `X-MCP-Token`, or `?token=`).
+    ///
+    /// Prefer setting this for any network-exposed MCP endpoint.
+    /// If omitted, falls back to the `RUSTAPI_MCP_TOKEN` environment variable.
+    #[arg(long)]
+    pub admin_token: Option<String>,
 }
 
 /// Execute `rustapi mcp generate`
@@ -115,13 +123,25 @@ pub async fn mcp_generate(args: McpGenerateArgs) -> Result<()> {
             config = config.allow_path_prefix(prefix.clone());
         }
 
+        let admin_token = args
+            .admin_token
+            .clone()
+            .or_else(|| std::env::var("RUSTAPI_MCP_TOKEN").ok())
+            .filter(|t| !t.is_empty());
+        if let Some(token) = &admin_token {
+            config = config.admin_token(token.clone());
+        }
+
         let mut mcp = McpServer::from_spec(config, &openapi);
         mcp = mcp.with_http_base(target.clone());
 
         let addr = format!("127.0.0.1:{}", args.port); // safer default for local tool
 
         println!("    ✓ Spec loaded");
         println!("    → Proxying tool calls to: {}", target);
+        if admin_token.is_some() {
+            println!("    → Admin token required on HTTP transport");
+        }
 
         if args.stdio {
             println!("🧠 MCP stdio transport active. Waiting for JSON-RPC on stdin...");
@@ -132,15 +152,20 @@ pub async fn mcp_generate(args: McpGenerateArgs) -> Result<()> {
         println!("    → MCP server listening on: http://{}", addr);
         println!();
         println!("Useful test commands:");
+        let auth_header = if admin_token.is_some() {
+            " -H 'Authorization: Bearer $RUSTAPI_MCP_TOKEN'"
+        } else {
+            ""
+        };
         println!(
-            "  curl -X POST http://127.0.0.1:{} -H 'content-type: application/json' \\",
-            args.port
+            "  curl -X POST http://127.0.0.1:{} -H 'content-type: application/json'{} \\",
+            args.port, auth_header
         );
         println!("       -d '{{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\"}}'");
         println!();
         println!(
-            "  curl -X POST http://127.0.0.1:{} -H 'content-type: application/json' \\",
-            args.port
+            "  curl -X POST http://127.0.0.1:{} -H 'content-type: application/json'{} \\",
+            args.port, auth_header
         );
         println!("       -d '{{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\"}}'");
         println!();

crates/cargo-rustapi/src/commands/mcp.rs

@@ -141,16 +141,17 @@ pub async fn new_project(mut args: NewArgs) -> Result<()> {
             "protocol-ws",
             "protocol-view",
             "protocol-grpc",
+            "protocol-mcp",
         ];
         let preset_features = preset
             .map(ProjectPreset::recommended_features)
             .unwrap_or_default();
         let defaults = match template {
             ProjectTemplate::Full => vec![
-                true, true, true, true, false, false, false, false, false, false, false,
+                true, true, true, true, false, false, false, false, false, false, false, false,
             ],
             ProjectTemplate::Web => vec![
-                false, false, false, false, false, false, false, false, false, true, false,
+                false, false, false, false, false, false, false, false, false, true, false, false,
             ],
             _ => vec![false; available.len()],
         };
@@ -257,6 +258,17 @@ pub async fn new_project(mut args: NewArgs) -> Result<()> {
         style("http://localhost:8080/docs").cyan()
     );
 
+    if features.iter().any(|f| f == "protocol-mcp") {
+        println!(
+            "MCP tools (if enabled in main) at {}",
+            style("http://localhost:9090").cyan()
+        );
+        println!(
+            "  Set {} to require a token on the MCP HTTP transport.",
+            style("RUSTAPI_MCP_TOKEN").yellow()
+        );
+    }
+
     Ok(())
 }