[codex] Harden MCP release readiness

.env.example

@@ -3,9 +3,20 @@ ENVIRONMENT="development"                              # deployment environment
 LOG_LEVEL="INFO"                                       # logging verbosity
 BYPASS_AUTH="0"                                        # set to "1" to disable auth (development only)
 CORS_ALLOW_ORIGINS=""                                  # comma-separated list of allowed origins
+MCP_AUTH_ISSUER=""                                     # OIDC issuer URL for MCP bearer-token validation
+MCP_AUTH_AUDIENCE=""                                   # Expected JWT audience (comma-separated values allowed)
+MCP_AUTH_JWKS_URL=""                                   # OIDC JWKS URL used to verify JWT signatures
+MCP_AUTH_REQUIRED_SCOPES="tox:read"                    # Space/comma-separated scopes required for MCP calls
+MCP_RESOURCE_URL="http://localhost:8000/mcp"           # Canonical protected MCP resource URL
+MCP_RATE_LIMIT_REQUESTS_PER_MINUTE="120"               # Per-subject/IP tool-call limit; 0 disables local limiter
+MCP_RATE_LIMIT_BURST="20"                              # Token-bucket burst size for MCP tool calls
 
 # CTX (Comptox) API
 CTX_API_BASE_URL="https://comptox.epa.gov/ctx-api"    # Default CTX API server
+# Request a free CTX API key from ccte_api@epa.gov.
+# Official docs:
+# - https://www.epa.gov/comptox-tools/computational-toxicology-and-exposure-apis
+# - https://www.epa.gov/comptox-tools/computational-toxicology-and-exposure-apis-about
 CTX_API_KEY="your_ctx_api_key_here"                   # Required for CTX APIs (do not commit real key)
 CTX_USE_LEGACY="0"                                    # Set to "1" to use https://api-ccte.epa.gov until 2025-10-01
 EPA_COMPTOX_API_KEY=""                                 # Legacy env name also supported (fallback)
@@ -16,3 +27,4 @@ CTX_RETRY_BASE="0.5"                                   # Base delay (seconds) fo
 EPACOMP_MCP_HEARTBEAT_TIMEOUT_SECONDS="120"           # Minimum heartbeat timeout negotiated with clients
 EPACOMP_MCP_HANDSHAKE_TIMEOUT_SECONDS="30"            # Minimum handshake timeout negotiated with clients
 EPACOMP_MCP_METRICS_ENABLED="1"                       # Expose /metrics endpoint
+MCP_METRICS_BYPASS_AUTH="0"                           # Set to "1" only when a trusted gateway protects metrics

.gitignore

@@ -49,3 +49,10 @@ htmlcov/
 artifacts/
 dist/
 build/
+
+# Internal review and generated research artifacts
+/AUDIT_MCP_*.md
+/ToxMCP_Audit_Reviewed_*/
+/scientific_engine_bundle.txt
+/triclosan_*.png
+/epa_comptox_api_structure.json