Serve MCP over HTTPS for the Claude Desktop connector

Claude Desktop's custom connector only accepts https URLs. Added an optional TLS listener (HTTPS_ADDR + TLS_CERT_FILE/TLS_KEY_FILE) alongside HTTP; docker-compose publishes 127.0.0.1:8443 and mounts a local mkcert cert from certs/ (git-ignored). Best-effort: a missing cert logs a warning and stays HTTP-only. Verified the Windows store trusts the mkcert cert and MCP initialize succeeds over https://127.0.0.1:8443/mcp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cmd/server/main.go

@@ -110,6 +110,22 @@ func main() {
 	}()
 	log.Info("listening", "addr", cfg.ListenAddr)
 
+	// Optional HTTPS listener (same Echo app). Required for the MCP connector,
+	// which only accepts https:// URLs (§8.1). Best-effort: a missing/unreadable
+	// cert logs a warning and leaves the app running over HTTP.
+	if cfg.HTTPSAddr != "" && cfg.TLSCertFile != "" && cfg.TLSKeyFile != "" {
+		if _, err := os.Stat(cfg.TLSCertFile); err != nil {
+			log.Warn("HTTPS requested but cert not readable — serving HTTP only", "cert", cfg.TLSCertFile, "err", err)
+		} else {
+			go func() {
+				if err := e.StartTLS(cfg.HTTPSAddr, cfg.TLSCertFile, cfg.TLSKeyFile); err != nil && err != http.ErrServerClosed {
+					log.Error("TLS server error", "err", err)
+				}
+			}()
+			log.Info("listening (https)", "addr", cfg.HTTPSAddr)
+		}
+	}
+
 	quit := make(chan os.Signal, 1)
 	signal.Notify(quit, os.Interrupt, syscall.SIGTERM)
 	<-quit