DuckDB MCP Server

Token Management

Current Auth Model

This server uses a static bearer token stored in .env as MCP_BEARER_TOKEN. The token is validated on every request. Invalid or missing tokens receive an HTTP 401 response with a WWW-Authenticate header (MCP spec compliant).

Token Storage Rules

• Token lives in .env ONLY — never hardcoded in source

• .env is listed in .gitignore — never committed to GitHub

• .env.example contains the key name only, no value:

  MCP_BEARER_TOKEN=

Token Rotation Procedure

Rotate the token any time you suspect exposure, or on a scheduled basis (recommended: every 90 days).

Step 1 — Generate a new token Run this in your terminal to generate a secure random token:

python -c "import secrets; print(secrets.token_urlsafe(32))"

Step 2 — Update .env in Codespaces

# Open .env
nano .env

# Replace the value:
MCP_BEARER_TOKEN=<paste new token here>

# Save and exit: Ctrl+X → Y → Enter

Step 3 — Update Fuelix

• Go to your MCP server config in Fuelix (ideas.fuelix.ai or copilot settings)

• Update the bearer token to match the new value

• Save

Step 4 — Restart the server

# If running with uvicorn:
uvicorn main:app --host 0.0.0.0 --port 8000 --reload

Step 5 — Verify

# Test with new token — should return 200:
curl -H "Authorization: Bearer <new_token>" https://localhost:8000/health

# Test with old token — should return 401:
curl -H "Authorization: Bearer <old_token>" https://localhost:8000/health

Step 6 — Confirm and close

• Old token is now invalid

• No code changes needed — token lives in env only

• Document rotation date below

Rotation Log