v0.8.0 — Production Hardening

What's New in v0.8.0

API Key Authentication

• Optional X-API-Key header security on all tool endpoints
• Backward-compatible: leave MCP_BRIDGEKIT_API_KEY empty to run open
• Structured UNAUTHORIZED / MISSING_API_KEY error codes on rejection

Rate Limiting

• Per-user fixed-window rate limiter backed by Redis
• Configurable via MCP_BRIDGEKIT_RATE_LIMIT_PER_MINUTE (default: 60 req/min)
• Returns HTTP 429 with RATE_LIMITED error code when exceeded

Retry with Exponential Backoff

• Configurable retry attempts on transient tool-call failures
• Exponential backoff: 2^attempt seconds between retries
• Session is evicted and reconnected before each retry
• Set via MCP_BRIDGEKIT_MAX_TOOL_RETRIES (default: 2)

Prometheus Metrics Endpoint

• New GET /metrics returns Prometheus text exposition format
• Exposes: active_sessions, max_sessions, requests_total, errors_total, queued_jobs, known_tools, cached_tool_lists
• Public endpoint (no auth required)

Structured Error Codes

• New ErrorCode enum: SESSION_CREATE_FAILED, TOOL_CALL_FAILED, TOOL_TIMED_OUT, RATE_LIMITED, JOB_NOT_FOUND, UNAUTHORIZED
• All error responses include a machine-readable error_code field

New Environment Variables

Variable	Default	Description
MCP_BRIDGEKIT_API_KEY	"" (disabled)	Shared secret for X-API-Key auth
MCP_BRIDGEKIT_RATE_LIMIT_PER_MINUTE	60	Max requests per user per minute
MCP_BRIDGEKIT_MAX_TOOL_RETRIES	2	Max retry attempts on tool failure

Full Changelog

• auth.py — new FastAPI dependency module
• models.py — ErrorCode enum
• core.py — _check_rate_limit(), retry loop, structured error yields
• app.py — auth wired on protected routes, /metrics endpoint added
• 17 unit tests (9 new) — all passing