Summary

• Guard direct API-token mode against missing/empty Bearer tokens and return 401 instead of throwing.
• Map combined /user + /accounts 400 identity-probe failures to 401 malformed-token responses.
• Downgrade expected identity-probe auth failures from console.error to console.warn and make 403 scope failures clearer.
• Add regression coverage for empty Bearer headers and combined 400 responses.

Why

Fleet logs showed malformed direct-token requests producing noisy errors and potential user-facing 500s. These are client auth failures, not server failures.

Validation

• pnpm --filter @repo/mcp-common test
• pnpm --filter @repo/mcp-common check:types
• pnpm exec turbo check:types --filter=@repo/mcp-common --filter=cloudflare-ai-gateway-mcp-server --filter=auditlogs --filter=cloudflare-autorag-mcp-server --filter=cloudflare-browser-mcp-server --filter=cloudflare-casb-mcp-server --filter=dex-analysis --filter=dns-analytics --filter=graphql-mcp-server --filter=logpush --filter=cloudflare-radar-mcp-server --filter=containers-mcp --filter=workers-bindings --filter=workers-builds --filter=workers-observability --filter=docs-ai-search --filter=docs-vectorize
• pnpm check:format (passes; prettier plugin prints existing import sorting aborted due to babel parsing error warning)

Note: pnpm types still fails on @repo/mcp-observability because that package has no Wrangler config; targeted typechecks above pass.