Echo tunnel active; authenticated MCP at /mcp