From d27495960af23969f11d6e1e44e2018529c1c37e Mon Sep 17 00:00:00 2001 From: Jeremiah Lowin <153965+jlowin@users.noreply.github.com> Date: Mon, 30 Mar 2026 09:32:38 -0400 Subject: [PATCH] docs: note that custom routes are unauthenticated (#3706) --- docs/deployment/http.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/deployment/http.mdx b/docs/deployment/http.mdx index caba09c47..d2078db1b 100644 --- a/docs/deployment/http.mdx +++ b/docs/deployment/http.mdx @@ -115,6 +115,10 @@ async def health_check(request): This health endpoint will be available at `http://localhost:8000/health` and can be used by load balancers, monitoring systems, or deployment platforms to verify your server is running. + +Custom routes are never protected by the server's authentication middleware, even when an `AuthProvider` is configured. This is by design — the primary use case for custom routes is unauthenticated operational endpoints like health checks and readiness probes. If you need authenticated HTTP endpoints alongside your MCP server, [mount it in a FastAPI app](/integrations/fastapi) and use FastAPI's `Depends()` for auth on your routes. + + ### Custom Middleware