Add files via upload

README.md

@@ -262,21 +262,33 @@ go build -o cyberstrike-ai cmd/server/main.go
    ```
    Replace the paths with your local locations; Cursor will launch the stdio server automatically.
 
-#### MCP HTTP quick start
-1. Ensure `config.yaml` has `mcp.enabled: true` and adjust `mcp.host` / `mcp.port` if you need a non-default binding (localhost:8081 works well for local Cursor usage).
-2. Start the main service (`./run.sh` or `go run cmd/server/main.go`); the MCP endpoint lives at `http://<host>:<port>/mcp`.
-3. In Cursor, choose **Add Custom MCP → HTTP** and set `Base URL` to `http://127.0.0.1:8081/mcp`.
-4. Prefer committing the setup via `.cursor/mcp.json` so teammates can reuse it:
-   ```json
-   {
-     "mcpServers": {
-       "cyberstrike-ai-http": {
-         "transport": "http",
-         "url": "http://127.0.0.1:8081/mcp"
-       }
-     }
-   }
-   ```
+#### MCP HTTP quick start (Cursor / Claude Code)
+The HTTP MCP server runs on a separate port (default `8081`) and supports **header-based authentication** so only clients that send the correct header can call tools.
+
+1. **Enable MCP in config** – In `config.yaml` set `mcp.enabled: true` and optionally `mcp.host` / `mcp.port`. For auth (recommended if the port is reachable from the network), set:
+   - `mcp.auth_header` – header name (e.g. `X-MCP-Token`);
+   - `mcp.auth_header_value` – secret value. **Leave it empty** if you want the server to **auto-generate** a random token on first start and write it back to the config.
+2. **Start the service** – Run `./run.sh` or `go run cmd/server/main.go`. The MCP endpoint is `http://<host>:<port>/mcp` (e.g. `http://localhost:8081/mcp`).
+3. **Copy the JSON from the terminal** – When MCP is enabled, the server prints a **ready-to-paste** JSON block. If `auth_header_value` was empty, it will have been generated and saved; the printed JSON includes the URL and headers.
+4. **Use in Cursor or Claude Code**:
+   - **Cursor**: Paste the block into `~/.cursor/mcp.json` (or your project’s `.cursor/mcp.json`) under `mcpServers`, or merge it into your existing `mcpServers`.
+   - **Claude Code**: Paste into `.mcp.json` or `~/.claude.json` under `mcpServers`.
+
+Example of what the terminal prints (with auth enabled):
+```json
+{
+  "mcpServers": {
+    "cyberstrike-ai": {
+      "url": "http://localhost:8081/mcp",
+      "headers": {
+        "X-MCP-Token": "<auto-generated-or-your-value>"
+      },
+      "type": "http"
+    }
+  }
+}
+```
+If you do not set `auth_header` / `auth_header_value`, the endpoint accepts requests without authentication (suitable only for localhost or trusted networks).
 
 #### External MCP federation (HTTP/stdio/SSE)
 CyberStrikeAI supports connecting to external MCP servers via three transport modes:
@@ -396,6 +408,8 @@ mcp:
   enabled: true
   host: "0.0.0.0"
   port: 8081
+  auth_header: "X-MCP-Token"       # optional; leave empty for no auth
+  auth_header_value: ""            # optional; leave empty to auto-generate on first start
 openai:
   api_key: "sk-xxx"
   base_url: "https://api.deepseek.com/v1"