From 35eb4113707ff8f343d3f441fb5f48f8b6882eb4 Mon Sep 17 00:00:00 2001
From: hermes <hermes@local>
Date: Fri, 10 Jul 2026 01:03:56 +0200
Subject: [PATCH] fix: /images/ public (no Bearer auth required)

---
 server.mjs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server.mjs b/server.mjs
index 3397d65..73bb303 100644
--- a/server.mjs
+++ b/server.mjs
@@ -556,8 +556,8 @@ await mcpServer.connect(mcpTransport);
 const httpServer = http.createServer(async (req, res) => {
   const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
 
-  // Auth gate — skip /health only
-  if (!url.pathname.startsWith('/health')) {
+  // Auth gate — skip /health and /images/
+  if (!url.pathname.startsWith('/health') && !url.pathname.startsWith('/images/')) {
     const auth = req.headers.authorization || '';
     const expected = `Bearer ${MCP_TOKEN}`;
     if (auth !== expected) {