Fix critical security issue: Enforce API key requirement for MCP clients

SECURITY FIX:
- MCP clients were bypassing API key requirement and using Space API key
- Now properly distinguish between web browser requests and MCP client requests
- Space API key only used for web browser demo requests
- MCP clients MUST provide their own API key via headers

Changes:
- Add User-Agent detection to identify web browsers vs MCP clients
- Enforce strict API key requirement for all MCP client requests
- Provide detailed error message with configuration example
- Maintain web demo functionality for browser users

This ensures:
✅ Web demo works for browser users (limited usage)
❌ MCP clients cannot use Space API key (security)
✅ MCP clients must provide own API key (production usage)

app.py

@@ -29,15 +29,46 @@ def get_api_client():
     is_space = os.getenv("SPACE_ID") is not None
     space_api_key = os.getenv("A1D_API_KEY")
 
-    # 3. Use environment variable only if on Hugging Face Space
-    if not api_key and is_space and space_api_key:
-        print("📡 Using API key from Space environment variable")
+    # 3. Determine if this is a web browser request or MCP client request
+    is_web_request = False
+    try:
+        request = gr.request()
+        if request and hasattr(request, 'headers'):
+            user_agent = request.headers.get('user-agent', '').lower()
+            # Web browsers typically have 'mozilla' in user agent
+            is_web_request = 'mozilla' in user_agent or 'chrome' in user_agent or 'safari' in user_agent
+    except:
+        is_web_request = True  # Default to web request if we can't determine
+
+    # 4. Use Space API key ONLY for web browser requests on Hugging Face Space
+    if not api_key and is_space and space_api_key and is_web_request:
+        print("📡 Using API key from Space environment variable (web demo)")
         return A1DAPIClient(space_api_key)
 
-    # 4. If not on Space or no API key provided, require user API key
+    # 5. For MCP clients, API key is mandatory
     if not api_key:
         raise ValueError(
-            "API key is required. Please provide API_KEY in request headers. Get your API key at https://a1d.ai")
+            "🔑 API key is required for MCP clients!\n\n"
+            "Please provide API_KEY in request headers.\n"
+            "Get your API key at https://a1d.ai\n\n"
+            "Configuration example:\n"
+            '{\n'
+            '  "mcpServers": {\n'
+            '    "a1d": {\n'
+            '      "command": "npx",\n'
+            '      "args": [\n'
+            '        "mcp-remote@latest",\n'
+            '        "https://aigchacker-a1d-mcp-server.hf.space/gradio_api/mcp/sse",\n'
+            '        "--header",\n'
+            '        "API_KEY:${MCP_API_KEY}"\n'
+            '      ],\n'
+            '      "env": {\n'
+            '        "MCP_API_KEY": "your_a1d_api_key_here"\n'
+            '      }\n'
+            '    }\n'
+            '  }\n'
+            '}'
+        )
 
     print("🔑 Using API key from MCP client headers")
     return A1DAPIClient(api_key)