127.0.0.1 only — never
the LAN — and writes the bound port plus a bearer token to a discovery
file on disk so MCP wrappers, benchmark scripts, and shell automation
can find it without configuration.
Discovery file
chmod 600, JSON shape:
Authentication
Every endpoint except/health requires:
Response envelope
Both shapes are returned with HTTP 200:ok:false with a machine-readable code.
Endpoints
Full schema is in
openapi.yaml.
