Addresses review feedback: a custom auth factory skips the guest-token
verifier entirely, and leaving GUEST_TOKEN_JWT_SECRET at its default with
guest auth enabled fails MCP startup rather than just being insecure.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The doc referenced a nonexistent MCP_GUEST_DENIED_TOOLS setting; guest
tool access is actually governed by the default-deny MCP_GUEST_ALLOWED_TOOLS
allow-list.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
PR #41003 added embedded guest-token auth to the MCP service
(MCP_EMBEDDED_GUEST_AUTH_ENABLED, MCP_GUEST_DENIED_TOOLS) but only
documented it in the service's internal SECURITY.md/CLAUDE.md — the
public admin docs' Authentication section never mentioned it.
Co-Authored-By: Claude <noreply@anthropic.com>