diff --git a/open_terminal/mcp_server.py b/open_terminal/mcp_server.py
index 9154d3f..7a691f6 100644
--- a/open_terminal/mcp_server.py
+++ b/open_terminal/mcp_server.py
@@ -1,9 +1,23 @@
 """MCP server — exposes every FastAPI endpoint as an MCP tool."""
 
+import hmac
+
 from fastmcp import FastMCP
+from fastmcp.server.auth import AccessToken, TokenVerifier
 from open_terminal.main import app
 from open_terminal.env import API_KEY
 
+
+class ApiKeyVerifier(TokenVerifier):
+    """Accept a client bearer token only when it matches the API key."""
+
+    async def verify_token(self, token: str) -> AccessToken | None:
+        if not hmac.compare_digest(token, API_KEY):
+            return None
+        return AccessToken(token=token, client_id="open-terminal", scopes=[])
+
+
+# HTTP transports gate on the API key; stdio is local and never hits this layer.
 mcp = FastMCP.from_fastapi(
     app=app,
     name="Open Terminal",
@@ -12,4 +26,5 @@ mcp = FastMCP.from_fastapi(
             "Authorization": f"Bearer {API_KEY}",
         }
     },
-)
\ No newline at end of file
+    auth=ApiKeyVerifier(),
+)
diff --git a/pyproject.toml b/pyproject.toml
index 425da1e..ba8ef0d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -27,7 +27,7 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
-mcp = ["fastmcp>=2.0.0"]
+mcp = ["fastmcp>=4.0.0"]
 
 [project.scripts]
 open-terminal = "open_terminal.cli:main"