[sparkysolutions10-pixel]

Summary

Closes #419

Enables a streamable HTTP transport for the Lens MCP server alongside stdio, selectable via configuration.

Changes

• Configuration-based transport selection: server.run(options) accepts transport: 'stdio' | 'http' (or reads MCP_TRANSPORT env var, defaulting to 'stdio').
• Strict Authentication Guard for HTTP: HTTP exposure requires authentication via apiKey (or MCP_API_KEY). The server refuses to start without an API key when MCP_TRANSPORT=http.
• Request Authentication: All incoming HTTP requests to the MCP endpoint must provide credentials via Authorization: Bearer <key> or x-api-key: <key>, refusing unauthenticated requests with HTTP 401.
• Identical Tool Surface: Both stdio and HTTP transports connect to the same underlying BazaarMcpServer and expose identical tools (bazaar_search and paid_call).
• Examples & Documentation:
  • Updated examples/mcp-server/run.ts to log transport mode and enforce MCP_API_KEY for HTTP mode.
  • Documented running both transports with examples in examples/mcp-server/README.md and README.md.

Tests

• Added unit tests in tests/mcp.test.ts:
  • defaults to stdio transport when no options or env var is specified
  • refuses to start HTTP transport when apiKey / MCP_API_KEY is missing
  • starts HTTP transport with valid apiKey and enforces authentication on requests (verifies 401 on missing auth, 401 on wrong auth, and success with Bearer / x-api-key)
  • exposes identical tools across both stdio and HTTP setups
• All tests pass (npx vitest run tests/mcp.test.ts).

[sparkysolutions10-pixel]

@Miracle656 Closing this out as Issue #419 has been landed and merged via PR #521. Excited to see streamable HTTP transport supported on main!