Add Authentication to the MCP server's HTTP transport

[zeroSteiner]

This adds authentication support to the MCP server's HTTP transport by default. The docs have been updated to reflect what this is and how it works.

Verification

List the steps needed to make sure this thing works

• Run ./msfmcpd --mcp-transport http and see it print a random token
• Run MSF_MCP_AUTH_TOKEN="" ./msfmcpd --mcp-transport http and see that it does not print a token and that authentication is disabled
• Run MSF_MCP_AUTH_TOKEN="whatever" ./msfmcpd --mcp-transport http and see that authentication is enabled, it's set to "whatever" but should not be displayed
• Add a token to the configuration file per the docs and load it with ./msfmcpd --config path/to/config.yaml see that authentication is enabled
• Run MSF_MCP_AUTH_TOKEN="" ./msfmcpd --mcp-transport http again and see that authentication is disabled because the environment takes priority over the config

The token should only be printed when it's randomly generated; if it's set via the config or environment variable, the server should only print that authentication is enabled. Additionally, when authentication is disabled, that should be printed too so the user always knows the status, and the token is only printed when necessary.

Demo

Start it for a random token.

./msfmcpd --mcp-transport http                                                                                                                
[DEPRECATION NOTICE] json-schema support for MultiJSON is deprecated and will be removed in a future version. To stop using MultiJSON, add `JSON::Validator.use_multi_json = false` to your application's initialization code.
No configuration file specified, using defaults
Validating configuration...
Configuration valid
Generated random credentials for auto-started RPC server
Starting Metasploit RPC server...
RPC server started via msfrpcd (PID: 98530)
Waiting for RPC server to become available...
Waiting for RPC server to become available...
Waiting for RPC server to become available...
RPC server is ready
Connecting to Metasploit RPC at localhost:55553
Authenticating with Metasploit...
Authentication successful
Initializing MCP server...
Starting MCP server on HTTP transport...
Server listening on http://localhost:3000/
Authentication: Bearer token (auto-generated)
  Configure your MCP client with: Authorization: Bearer 6f8fe7274096253e82dc90ab0bc6be10d859a9088d5053dbe177125e2d45793c
Press Ctrl+C to shutdown

Configure Claude Code using the --header option:

claude mcp add --transport http metasploit http://localhost:3000/  --header 'Authorization: Bearer 6f8fe7274096253e82dc90ab0bc6be10d859a9088d5053dbe177125e2d45793c'

[Copilot]

Pull request overview

This PR adds optional Bearer-token authentication to the MCP server’s HTTP transport and wires it into startup/config so msfmcpd --mcp-transport http can enable auth by default (auto-generating and printing a token only when it’s randomly generated).

Changes:

• Add a Rack middleware (Msf::MCP::Middleware::BearerAuth) to enforce Authorization: Bearer <token> on HTTP requests.
• Add config + environment-variable support for mcp.auth_token, including explicit disabling via empty string / null and env-precedence behavior.
• Update startup output and documentation to explain authentication modes and client configuration.

Impact Analysis:

• Blast radius: medium — affects all MCP clients using the HTTP transport (authorization header now required by default for the CLI flow); stdio transport unaffected.
• Data and contract effects: HTTP request contract changes (401 + WWW-Authenticate on missing/incorrect header); config semantics add mcp.auth_token with env override.
• Rollback and test focus: verify auth precedence (config vs MSF_MCP_AUTH_TOKEN), auto-generation/printing rules, and 401 behavior (including challenge header) for missing/incorrect tokens.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
lib/msf/core/mcp/server.rb	Pass auth token into HTTP transport and mount BearerAuth middleware when configured.
lib/msf/core/mcp/middleware/bearer_auth.rb	New Rack middleware implementing Bearer token enforcement.
lib/msf/core/mcp/config/loader.rb	Normalize mcp.auth_token and add MSF_MCP_AUTH_TOKEN override semantics.
lib/msf/core/mcp/application.rb	Resolve auth mode at startup, auto-generate token when needed, and print status/messages.
lib/msf/core/mcp.rb	Require the new middleware.
docs/metasploit-framework.wiki/How-to-use-Metasploit-MCP-Server.md	Document HTTP auth behavior, env var, config options, and disabling.
config/mcp_config.yaml.example	Add commented auth_token example line.
config/mcp_config.yaml	Add a sample config file including an auth token (currently hard-coded).
.gitignore	Ignore local MCP config files.