Prerequisites
- Python 3.10+
ANTHROPIC_API_KEYHF_TOKEN— optional, free at huggingface.co/settings/tokens
Build it
1
Install and set your LLM key
2
Make the token optional, not required
mcp_api_key argument — pass "env:HF_TOKEN" when a token exists and None when it does not.3
Write a prompt that forbids recalled repo ids
Model names are exactly the kind of thing an LLM will produce from memory, confidently and wrongly. Half of this prompt exists to stop that:
4
Attach the token only if it exists
mcp_api_key="env:HF_TOKEN" sends Authorization: Bearer <token>, reading the value from the environment at connection time so the secret stays out of your source.5
Ask a question with real constraints
The complete script
Why the optional-auth shape is worth copying
Most integrations treat a credential as required and exit if it is missing. For a server that serves anonymous traffic, that turns a working demo into a broken one for anyone who has not signed up yet. The pattern generalizes to any server with a free anonymous tier:print above — so a rate-limit error later is not a mystery.
Next
- Semgrep — the required-Bearer-token case.
- Authentication patterns — every credential shape side by side.