When MCP_TOOLS_INCLUDED is set to a comma-separated list of tool names,
only those tools are exposed (tools/list and calls); unset or empty
exposes every generated tool. Unknown names are ignored with a startup
warning and the active selection is logged at startup.
When serving over HTTP, the key sent in the MCP_API_KEY_HEADER header
(default X-API-Key) is used as the API credential for that request and
takes precedence over the static API_TOKEN. The key is formatted with
API_AUTH_HEADER/API_AUTH_SCHEME and the source header is stripped from
the outgoing API request. Implemented as an httpx2 auth flow over
FastMCP's request context, so concurrent clients stay isolated.
MCP server generated from an OpenAPI document with FastMCP v4.
Configurable via env vars (spec URL/file, transport stdio/http,
host, port, API token), built with uv, multi-stage Dockerfile
with non-root runtime.
woggioni