Update server.py

server.py

@@ -125,8 +125,8 @@ llm = ChatOpenAI(
 # Hugging Face Token Auth Middleware
 class HuggingFaceTokenAuthMiddleware(BaseHTTPMiddleware):
     async def dispatch(self, request: Request, call_next):
-        # Only protect /mcp/ and /tools endpoints, allow "/" open
-        if request.url.path not in ["/", "/mcp/", "/tools"]:
+        # Allow "/" to be public, protect everything else
+        if request.url.path == "/":
             return await call_next(request)
         # Check Authorization header
         auth = request.headers.get("authorization")
@@ -142,6 +142,7 @@ class HuggingFaceTokenAuthMiddleware(BaseHTTPMiddleware):
             if resp.status_code != 200:
                 return PlainTextResponse("Invalid or expired Hugging Face token", status_code=401)
             hf_user_info = resp.json()
+        # Attach the HF user info to request.state for downstream use if needed
         request.state.hf_user = hf_user_info
         return await call_next(request)
 
@@ -224,7 +225,7 @@ async def list_tools(request: Request) -> JSONResponse:
     """Return all registered tool metadata as JSON."""
     return JSONResponse(tool_registry)
 
-# Add the Hugging Face token auth middleware at app construction time
+# --- Build the app and add middleware ---
 app = mcp.streamable_http_app()
 app.add_middleware(HuggingFaceTokenAuthMiddleware)