MCP_AUTH_TOKEN was stored in plain text in .mcp.json and thus in git
history. Now connect.sh reads the token from the environment variable
MCP_AUTH_TOKEN — set via export in ~/.bashrc or a secrets manager.
⚠️ Old token is in git history and should be rotated on the server.
Rotate: python manage.py create_agent_token <username>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>