If you run @testrelic/mcp as an HTTP server on anything other than localhost, upgrading from 3.4.1 changes how clients connect. The default npx setup over stdio and servers bound to localhost need no token, as before. The cache key and rate limit changes below apply to them too.
- Requests to
/mcp need a token. When the server listens on a non-loopback address, such as --host 0.0.0.0 or the Docker image, every request must send Authorization: Bearer <token>, using the token the server itself is configured with (--token, TESTRELIC_MCP_TOKEN or a saved login). A request without it gets 401 with the code UNAUTHORIZED. The token is checked with TestRelic Cloud when a session opens, so one the platform rejects gets 401 too. /healthz stays open.
- The server won't start without one. Beyond localhost with no token configured, startup stops and says why, unless the server is multi-tenant (below). If a proxy in front of the server already authenticates callers, set
TESTRELIC_MCP_REQUIRE_AUTH=false.
- New: one server for several people. On a server that requires a token, optionally set
TESTRELIC_MCP_MULTI_TENANT=true, and each caller sends their own tr_mcp_ token instead of the server's. Tools then see that caller's organization and repositories, and cached results are kept apart per caller. The hosted server at mcp.testrelic.ai works this way.
- The default repository no longer applies on a server that requires a token.
--default-repo-id and TESTRELIC_DEFAULT_REPO_ID are ignored there, so pass project_id when the token can see more than one repository.
- Clients that send an
Origin header are no longer refused by a server reachable beyond localhost. It answered 403 "Invalid Origin header" to browser-based and editor clients. A localhost-only server still checks Origin, and the Host check is unchanged: behind a proxy, list your public hostname in TESTRELIC_MCP_PUBLIC_HOSTS.
- Saved cache keys from 3.4.1 stop working, on any transport. A
cache_key now belongs to the caller it was issued to, and tr_fetch_cached answers that an older key "was not issued to this session". Run the tool that issued it again instead of reusing a stored key.
- Requests are rate limited.
/mcp allows 600 requests a minute per connecting address. Beyond that the answer is 429 with the code RATE_LIMITED. Behind a proxy the server sees one address, so all callers share the limit.
Released as @testrelic/mcp 3.4.3. To create a tr_mcp_ token, see MCP authentication. To use the hosted server instead of running your own, see the MCP quickstart.