pyr0ball cf283c9bba fix: close timing-attack and empty-secret auth bypass in MCP server ... check_bearer_token now uses hmac.compare_digest for constant-time comparison and rejects a falsy expected token outright, with a startup guard that fails loudly if HAVOC_MCP_TOKEN is set but empty. Adds Starlette TestClient coverage of the _BearerAuthMiddleware auth-enforcement path (no header, wrong token, correct token), and cleans up dead code found during review: unused token param on build_mcp_server, a per-request import, and an unused json import.		2026-07-04 07:22:55 -07:00
..
test_havoc_debug_protocol.py	feat: add watchpoint slot/DR7 bookkeeping to MCP protocol module	2026-07-04 06:58:46 -07:00
test_havoc_mcp_server.py	fix: close timing-attack and empty-secret auth bypass in MCP server	2026-07-04 07:22:55 -07:00