MCP only — use /mcp endpoint with Bearer token