MemPalace/mempalace · error · ValueError

MEMPALACE_MCP_HTTP_TOKEN is required when binding MCP HTTP t

Error message

MEMPALACE_MCP_HTTP_TOKEN is required when binding MCP HTTP to a non-loopback host. Set {_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV}=1 only when a trusted fronting layer provides access control.

What it means

Error "MEMPALACE_MCP_HTTP_TOKEN is required when binding MCP HTTP to a non-loopback host. Set {_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV}=1 only when a trusted fronting layer provides access control." thrown in MemPalace/mempalace.

Source

Thrown at mempalace/mcp_server.py:7519

def _build_http_server(host: str, port: int):
    """Construct (but do not start) the MCP HTTP server.

    Split out from :func:`_serve_http` so tests can bind an ephemeral port,
    exercise the *real* handler, and shut it down — the previous test reached
    for Starlette/uvicorn (neither a dependency) and so was silently skipped in
    CI. Returns a bound ``ThreadingHTTPServer`` whose request policy (Host
    allowlist, Origin check, optional bearer token) is attached as attributes.
    """
    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

    auth_token = os.environ.get("MEMPALACE_MCP_HTTP_TOKEN", "").strip()
    if (
        not _http_is_loopback(host)
        and not auth_token
        and not _truthy_env(_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV)
    ):
        raise ValueError(
            "MEMPALACE_MCP_HTTP_TOKEN is required when binding MCP HTTP to a "
            f"non-loopback host. Set {_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV}=1 only "
            "when a trusted fronting layer provides access control."
        )

    # Resolve TLS before bind so a bad cert/key fails loudly rather than at the
    # first request. TLS is transport encryption only — the bearer-token guard
    # above still applies on a non-loopback bind.
    tls_cert, tls_key = _resolve_tls_paths()

    class _MCPHTTPServer(ThreadingHTTPServer):
        daemon_threads = True
        allow_reuse_address = True

        def handle_error(self, request, client_address):
            # A client hanging up mid-response makes the send path raise
            # ConnectionError (BrokenPipeError / ConnectionResetError), or
            # ssl.SSLEOFError over TLS. That is a routine disconnect, not a

View on GitHub (pinned to 06cb6987f0)

Solutions

1. Set MEMPALACE_MCP_HTTP_TOKEN, or bind to a loopback host

When it happens

Trigger: Thrown at mempalace/mcp_server.py:7519 when the library encounters an invalid state.

Common situations: HTTP MCP was bound to a non-loopback interface without an auth token.

AI-assisted analysis of MemPalace/mempalace@06cb6987f0 (2026-08-15). Data as JSON: /api/errors/42984c216ffd5321. Report an issue: GitHub.