From c4270a49755ffb0a848edd0c8e2a6a25e1318f49 Mon Sep 17 00:00:00 2001 From: Developer Date: Mon, 13 Jul 2026 16:11:09 +0200 Subject: [PATCH] P1a: Ensure ApiKeyMiddleware skips /mcp endpoint The MCP endpoint handles its own authentication via X-Agent-Id and X-Nexus-Api-Key headers through NexusMcpTools. The ApiKeyMiddleware now skips the /mcp path to avoid interfering with MCP's own auth flow. --- backend/Middleware/ApiKeyMiddleware.cs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/backend/Middleware/ApiKeyMiddleware.cs b/backend/Middleware/ApiKeyMiddleware.cs index 5ab1c6f..69d21fa 100644 --- a/backend/Middleware/ApiKeyMiddleware.cs +++ b/backend/Middleware/ApiKeyMiddleware.cs @@ -6,11 +6,23 @@ namespace Nexus.Api.Middleware; /// Middleware that authenticates requests via the X-Nexus-Api-Key header. /// On match, sets a ClaimsPrincipal with role "Service". /// On mismatch or absent header, passes through to next middleware (JWT auth). +/// +/// The MCP endpoint (/mcp) is intentionally skipped — the MCP SDK handles its own +/// authentication via X-Agent-Id + X-Nexus-Api-Key headers through NexusMcpTools. /// public sealed class ApiKeyMiddleware(RequestDelegate next) { + private static readonly PathString McpPath = new("/mcp"); + public async Task InvokeAsync(HttpContext context) { + // MCP endpoint handles its own auth — skip ApiKey interference + if (context.Request.Path.StartsWithSegments(McpPath)) + { + await next(context); + return; + } + var configuration = context.RequestServices.GetRequiredService(); var apiKey = configuration["NexusApiKey"];