sarah-rag mcp — /mcp requires bearer auth