This PR introduces authentication for the MCP server when running with HTTP or SSE transports to protect against unauthorized access.

Changes

Configuration

• Added CLICKHOUSE_MCP_AUTH_TOKEN environment variable for bearer token authentication
• Added CLICKHOUSE_MCP_AUTH_DISABLED flag for development environments (defaults to false)

Implementation

• Integrated FastMCP's StaticTokenVerifier for token validation on HTTP/SSE transports
• Updated /health endpoint to enforce authentication
• Server fails fast if auth not configured for HTTP/SSE
• stdio transport remains unchanged

Breaking Changes:

HTTP and SSE transports now require authentication by default

Users running with CLICKHOUSE_MCP_SERVER_TRANSPORT=http or sse must either:

1. Set CLICKHOUSE_MCP_AUTH_TOKEN=<your-token> (recommended)
2. Set CLICKHOUSE_MCP_AUTH_DISABLED=true (development only)

Migration Guide

1. Generate a token:

   uuidgen  # or: openssl rand -hex 32

2. Add to your environment:
   export CLICKHOUSE_MCP_AUTH_TOKEN="your-generated-token"

3. Update client config to include the token in the Authorization header