Serve MCP over HTTPS for the Claude Desktop connector

Claude Desktop's custom connector only accepts https URLs. Added an optional TLS listener (HTTPS_ADDR + TLS_CERT_FILE/TLS_KEY_FILE) alongside HTTP; docker-compose publishes 127.0.0.1:8443 and mounts a local mkcert cert from certs/ (git-ignored). Best-effort: a missing cert logs a warning and stays HTTP-only. Verified the Windows store trusts the mkcert cert and MCP initialize succeeds over https://127.0.0.1:8443/mcp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -12,10 +12,17 @@ services:
       # Bind all interfaces INSIDE the container so the published port reaches
       # it; the `ports` mapping below still keeps it localhost-only on the HOST.
       - LISTEN_ADDR=0.0.0.0:8080
+      # HTTPS for the MCP connector (Claude Desktop only accepts https URLs).
+      # Certs are generated on the host with mkcert (see README/.env.example)
+      # and mounted read-only below.
+      - HTTPS_ADDR=0.0.0.0:8443
+      - TLS_CERT_FILE=/app/certs/localhost.pem
+      - TLS_KEY_FILE=/app/certs/localhost-key.pem
       # The scanner looks here; matches the volume mount below.
       - GIT_REPO_ROOTS=/repos
     ports:
       - "127.0.0.1:8080:8080"
+      - "127.0.0.1:8443:8443"
     volumes:
       # Source, for hot reload.
       - .:/app