No authentication configured - running in development mode

Error message

No authentication configured - running in development mode

What it means

Warning in HttpTransport.handleHttpRequest(): a request requires authentication but no auth config is present, so the transport logs and continues unauthenticated — development mode only. In production this means the server accepts unauthenticated requests.

Source

Thrown at v3/@claude-flow/shared/src/mcp/transport/http.ts:402

    if (requiresAuth && this.config.auth) {
      const authResult = this.validateAuth(req);
      if (!authResult.valid) {
        this.logger.warn('Authentication failed', {
          ip: req.ip,
          path: req.path,
          error: authResult.error,
        });
        res.status(401).json({
          jsonrpc: '2.0',
          id: null,
          error: { code: -32001, message: 'Unauthorized' },
        });
        return;
      }
    } else if (requiresAuth && !this.config.auth) {
      // No auth configured but auth is required - warn and continue (development mode)
      this.logger.warn('No authentication configured - running in development mode');
    }

    const message = req.body;

    // Validate JSON-RPC format
    if (message.jsonrpc !== '2.0') {
      res.status(400).json({
        jsonrpc: '2.0',
        id: message.id || null,
        error: { code: -32600, message: 'Invalid JSON-RPC version' },
      });
      return;
    }

    if (!message.method) {
      res.status(400).json({
        jsonrpc: '2.0',
        id: message.id || null,

View on GitHub (pinned to fa13ee4ad6)

Solutions

Configure authentication (e.g. MCP_AUTH_TOKEN) before exposing this transport beyond local development.

Defensive patterns

Strategy: fallback

When it happens

Trigger: Thrown at v3/@claude-flow/shared/src/mcp/transport/http.ts:402 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/206577b11dea107b. Report an issue: GitHub.