fix(mcp): stop counting requests without credentials toward the lockout

[datlechin]

Why

Five requests without an Authorization header inside 60 seconds locked every MCP client on the Mac out for 5 minutes. Every local client shares the loopback address key, so any local process could trigger it, and a client's normal probe, 401 challenge, retry-with-token flow (RFC 7235 §2.1) counted as a failed login.

Change

• A request with no Authorization header gets the 401 challenge and is no longer counted toward the auth lockout. It never reaches token validation, so it cannot be used to guess a token.
• A malformed header, a non-Bearer scheme, and an unknown, expired or revoked token still count. An active lockout still answers 429 to requests without a header.
• Anonymous loopback with Require authentication off is unchanged.
• Docs: the rate limits section now says what counts and that local clients share one lockout.

Verified

MCPBearerTokenAuthenticatorTests and MCPCompositeAuthenticatorTests: requests without a header never lock out and fail on main; bad credentials still lock out.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
TablePro	🟢 Ready	View Preview	Oct 10, 2026, 10:48 AM

💡 Tip: Enable Automations to automatically generate PRs for you.