{"record":{"id":"42984c216ffd5321","repo":"MemPalace/mempalace","slug":"mempalace-mcp-http-token-is-required-when-binding","errorCode":null,"errorMessage":"MEMPALACE_MCP_HTTP_TOKEN is required when binding MCP HTTP to a non-loopback host. Set {_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV}=1 only when a trusted fronting layer provides access control.","messagePattern":"MEMPALACE_MCP_HTTP_TOKEN is required when binding MCP HTTP to a non-loopback host\\. Set (.+?)=1 only when a trusted fronting layer provides access control\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"mempalace/mcp_server.py","lineNumber":7519,"sourceCode":"\ndef _build_http_server(host: str, port: int):\n    \"\"\"Construct (but do not start) the MCP HTTP server.\n\n    Split out from :func:`_serve_http` so tests can bind an ephemeral port,\n    exercise the *real* handler, and shut it down — the previous test reached\n    for Starlette/uvicorn (neither a dependency) and so was silently skipped in\n    CI. Returns a bound ``ThreadingHTTPServer`` whose request policy (Host\n    allowlist, Origin check, optional bearer token) is attached as attributes.\n    \"\"\"\n    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer\n\n    auth_token = os.environ.get(\"MEMPALACE_MCP_HTTP_TOKEN\", \"\").strip()\n    if (\n        not _http_is_loopback(host)\n        and not auth_token\n        and not _truthy_env(_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV)\n    ):\n        raise ValueError(\n            \"MEMPALACE_MCP_HTTP_TOKEN is required when binding MCP HTTP to a \"\n            f\"non-loopback host. Set {_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV}=1 only \"\n            \"when a trusted fronting layer provides access control.\"\n        )\n\n    # Resolve TLS before bind so a bad cert/key fails loudly rather than at the\n    # first request. TLS is transport encryption only — the bearer-token guard\n    # above still applies on a non-loopback bind.\n    tls_cert, tls_key = _resolve_tls_paths()\n\n    class _MCPHTTPServer(ThreadingHTTPServer):\n        daemon_threads = True\n        allow_reuse_address = True\n\n        def handle_error(self, request, client_address):\n            # A client hanging up mid-response makes the send path raise\n            # ConnectionError (BrokenPipeError / ConnectionResetError), or\n            # ssl.SSLEOFError over TLS. That is a routine disconnect, not a","sourceCodeStart":7501,"sourceCodeEnd":7537,"githubUrl":"https://github.com/MemPalace/mempalace/blob/06cb6987f02610784fefbad4b2bd5d026d164ba6/mempalace/mcp_server.py#L7501-L7537","documentation":"Error \"MEMPALACE_MCP_HTTP_TOKEN is required when binding MCP HTTP to a non-loopback host. Set {_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV}=1 only when a trusted fronting layer provides access control.\" thrown in MemPalace/mempalace.","triggerScenarios":"Thrown at mempalace/mcp_server.py:7519 when the library encounters an invalid state.","commonSituations":"HTTP MCP was bound to a non-loopback interface without an auth token.","solutions":["Set MEMPALACE_MCP_HTTP_TOKEN, or bind to a loopback host"],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"06cb6987f02610784fefbad4b2bd5d026d164ba6","analyzedAt":"2026-08-15T03:03:36.213Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}