pub fn server_token(cap: &CapabilityConfig) -> Option<String>Expand description
P5-8: read capabilities.server.token — the bearer token a remote HTTP
client must present (§ security posture: stdio transports are parent-
process-trusted and need no token; HTTP does). None (unset) means the
runtime mints a random per-session token instead of trusting a
operator-chosen fixed value.