MCP SSE transport GET — opens event stream for dnakov/claude-mcp.

Sends event: endpoint with POST URL, then a keepalive : ping every ~30 s while idle (bb16f9a7) so intermediary proxies (Fly / Cloudflare) don't drop the idle connection. Uses the same _db() resolver (Bearer / cookie) so both local and hosted-tier clients work.

ece2ac0a — hosted callers must authenticate (401 with the same OAuth discovery challenge as POST /mcp). The session stores the full MCP context (tenant, token type, workspace role and scope) plus a reference to the credential that opened it; see the section comment above for how message POSTs use it.