Serve MCP over HTTPS for the Claude Desktop connector

Claude Desktop's custom connector only accepts https URLs. Added an optional TLS listener (HTTPS_ADDR + TLS_CERT_FILE/TLS_KEY_FILE) alongside HTTP; docker-compose publishes 127.0.0.1:8443 and mounts a local mkcert cert from certs/ (git-ignored). Best-effort: a missing cert logs a warning and stays HTTP-only. Verified the Windows store trusts the mkcert cert and MCP initialize succeeds over https://127.0.0.1:8443/mcp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/config/config.go

@@ -14,7 +14,14 @@ import (
 
 // Config is the typed application configuration.
 type Config struct {
-	ListenAddr string // address the HTTP server binds to
+	ListenAddr string // address the plain HTTP server binds to
+
+	// TLS: when HTTPSAddr and both cert/key files are set, an HTTPS listener is
+	// started in addition to the HTTP one. Claude Desktop's MCP connector only
+	// accepts https:// URLs, so /mcp must be reachable over TLS (AGENT.md §8.1).
+	HTTPSAddr   string // address the HTTPS server binds to ("" disables TLS)
+	TLSCertFile string // PEM cert (e.g. an mkcert leaf trusted by the OS store)
+	TLSKeyFile  string // PEM private key
 
 	RepoRoots []string // roots to scan for git repositories
 	GitBin    string   // path to the git binary
@@ -38,6 +45,9 @@ func Load() (Config, error) {
 
 	c := Config{
 		ListenAddr:       env("LISTEN_ADDR", "127.0.0.1:8080"),
+		HTTPSAddr:        env("HTTPS_ADDR", ""),
+		TLSCertFile:      env("TLS_CERT_FILE", ""),
+		TLSKeyFile:       env("TLS_KEY_FILE", ""),
 		RepoRoots:        splitList(env("GIT_REPO_ROOTS", "")),
 		GitBin:           env("GIT_BIN", "git"),
 		ScanMaxDepth:     envInt("SCAN_MAX_DEPTH", 4),