django-native-mcp v0.1.1

Added

• Bearer-token authentication for Streamable HTTP MCP endpoints.
• New MCPToken model with:
  • DRF-compatible 40-character token generation;
  • associated Django user;
  • created;
  • last_used;
  • optional expires.
• Django admin support for managing MCP tokens.
• Configurable authentication backends through:

DJANGO_NATIVE_MCP = {
    "DEFAULT_AUTHENTICATION_CLASSES": [
        "django_native_mcp.authentication.MCPTokenBackend",
    ],
}

• Public MCP mode by setting DEFAULT_AUTHENTICATION_CLASSES to None or [].

Behavior

HTTP MCP endpoints are protected by default. Clients must send:

Authorization: Bearer <token>

Missing, expired, inactive, or invalid tokens return 401 Unauthorized.

Permissions and scopes are not included yet. Any valid token currently grants access to all registered tools.

Validation

• 38 tests passing
• Ruff checks passing
• mypy passing
• Django system checks passing
• Verified against the tracked Django demo using the official MCP Streamable HTTP client