Add optional Authorization header token-based authentication when serving mcp via SSE

[Red5d]

Add an optional AuthenticationMiddleware backend that can check for an Authorization header value from clients connecting when serving an mcp server via SSE.

[sparfenyuk]

Thanks, looks great.

[Red5d]

Thanks, I've removed the leftover debugging lines.

[codecov]

Codecov Report

❌ Patch coverage is 36.84211% with 12 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/mcp_proxy/sse_server.py	36.84%	11 Missing and 1 partial ⚠️

@@            Coverage Diff             @@
##             main      #58      +/-   ##
==========================================
- Coverage   96.75%   93.81%   -2.95%     
==========================================
  Files           4        4              
  Lines         370      388      +18     
  Branches        8       12       +4     
==========================================
+ Hits          358      364       +6     
- Misses         11       22      +11     
- Partials        1        2       +1     

Files with missing lines	Coverage Δ
src/mcp_proxy/sse_server.py	63.15% <36.84%> (-13.77%)	⬇️

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e9fe649...206a75e. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sparfenyuk]

You may find the following two commands useful to fix the broken CI:

pre-commit run -a
uv run mypy src

[sparfenyuk]

@Red5d can you also add some unit tests?

[allenporter]

There are a couple of existing conventions either the API_ACCESS_TOKEN env var or --headers and I believe these for going in the opposite direction. It might be helpful to explicitly clarify here the difference (e.g. explicitly state this is adding authentication to the proxy itself, and not passed to the downstream SSE server like the others. (Either clarifying those or this one or both)

Also suggest updating README.md

[Red5d]

This is adding header-based authentication to the proxy, yes. Specifying the expected "Bearer" value for the "Authorization" header. I'm certainly willing to change the naming or something if that would be better though.

[Red5d]

@Red5d can you also add some unit tests?

To test that providing the Authorization header token value actually prevents access without it? Would that be done in here?: https://github.com/sparfenyuk/mcp-proxy/blob/main/tests/test_sse_server.py