@ateam-ai/mcp 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai/mcp",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "mcpName": "io.github.ariekogan/ateam-mcp",
   "description": "A-Team MCP Server — build, validate, and deploy multi-agent solutions from any AI environment",
   "type": "module",

package/src/http.js

@@ -417,9 +417,16 @@ function seedCredentials(req, sessionId) {
     return;
   }
 
-  // Default: use the bearer token itself as credentials
+  // Default: use the bearer token itself as credentials.
+  // `explicit: true` — a Bearer is a per-connection credential the user
+  // deliberately configured (OAuth authorize page, or the plugin's userConfig
+  // key injected as `Authorization: Bearer`). Unlike an ambient ADAS_API_KEY
+  // env var baked into shared MCP config, it carries explicit tenant intent, so
+  // it satisfies isExplicitlyAuthenticated and tenant tools work without a
+  // redundant ateam_auth call. (The env-var guard in tools.js is unaffected —
+  // env creds never flow through here; this path only fires for a real Bearer.)
   const parsed = parseApiKey(token);
   if (parsed.isValid) {
-    setSessionCredentials(sessionId, { tenant: parsed.tenant, apiKey: token });
+    setSessionCredentials(sessionId, { tenant: parsed.tenant, apiKey: token, explicit: true });
   }
 }