fix: C3 case-insensitive Bearer prefix + S1 MCP asyncio.Lock (closes 2 xfail)

agent_platform/auth.py

@@ -15,7 +15,12 @@ async def get_current_user(
     if not authorization:
         raise HTTPException(status_code=401, detail="Missing Authorization header")
 
-    token = authorization.replace("Bearer ", "").strip()
+    # Case-insensitive Bearer prefix handling (C3)
+    auth_value = authorization.strip()
+    if auth_value.lower().startswith("bearer "):
+        token = auth_value[7:].strip()
+    else:
+        token = auth_value
 
     # Static-Auth-Token als Master-Key (für Setup/Bootstrap)
     if token == settings.AUTH_TOKEN:

agent_platform/mcp_client.py

@@ -1,4 +1,5 @@
 """MCP-Client: Verbindung zum Tool-Server."""
+import asyncio
 from typing import List, Dict, Any, Optional
 from mcp import ClientSession
 from mcp.client.streamable_http import streamablehttp_client
@@ -12,16 +13,18 @@ class MCPClient:
         self._session: Optional[ClientSession] = None
         self._streams = None
         self._ctx = None
+        self._lock = asyncio.Lock()
 
     async def connect(self):
         """Stellt Verbindung zum MCP-Server her (lazy + reconnect-fähig)."""
-        if self._session:
+        async with self._lock:
-            return
+            if self._session:
-        self._ctx = streamablehttp_client(url=self.server_url)
+                return
-        read, write, _ = await self._ctx.__aenter__()
+            self._ctx = streamablehttp_client(url=self.server_url)
-        self._session = ClientSession(read, write)
+            read, write, _ = await self._ctx.__aenter__()
-        await self._session.__aenter__()
+            self._session = ClientSession(read, write)
-        await self._session.initialize()
+            await self._session.__aenter__()
+            await self._session.initialize()
 
     async def disconnect(self):
         if self._session:
@@ -76,8 +79,8 @@ class MCPClient:
         """Prüft ob MCP-Server erreichbar ist."""
         try:
             await self.connect()
-            return True
+            return self._session is not None
-        except Exception:
+        except BaseException:
             return False