Fix: enforce MCP token length too

src/utils/mcp/homepage-mcp.js

@@ -12,6 +12,8 @@ const SERVER_INFO = {
   version: "1.0.0",
 };
 
+const MIN_TOKEN_LENGTH = 32;
+
 const CONFIG_FILES = [
   "settings.yaml",
   "services.yaml",
@@ -442,9 +444,18 @@ export function mcpEnabled() {
   return enabled();
 }
 
+export function mcpTokenConfigError() {
+  if (!enabled()) return null;
+  const token = requiredToken();
+  if (token && token.length < MIN_TOKEN_LENGTH) {
+    return `HOMEPAGE_MCP_TOKEN must be at least ${MIN_TOKEN_LENGTH} characters. Generate one with: openssl rand -base64 32`;
+  }
+  return null;
+}
+
 export function mcpTokenAuthorized(req) {
   const token = requiredToken();
-  if (!token) return false;
+  if (!token || token.length < MIN_TOKEN_LENGTH) return false;
 
   const authHeader = req.headers.authorization;
   const bearerToken = typeof authHeader === "string" && authHeader.startsWith("Bearer ") ? authHeader.slice(7) : null;