fix auth

mcp_fuzzer/auth/loaders.py

@@ -68,6 +68,13 @@ def setup_auth_from_env() -> AuthManager:
     default_provider = os.getenv("MCP_DEFAULT_AUTH_PROVIDER")
     if default_provider:
         auth_manager.set_default_provider(default_provider)
+    elif len(auth_manager.auth_providers) == 1:
+        # If only one provider exists, set it as default for convenience
+        provider_name = next(iter(auth_manager.auth_providers.keys()))
+        auth_manager.set_default_provider(provider_name)
+    elif "api_key" in auth_manager.auth_providers:
+        # Prefer api_key as default if multiple providers exist
+        auth_manager.set_default_provider("api_key")
 
     return auth_manager
 

mcp_fuzzer/auth/manager.py

@@ -45,10 +45,26 @@ def get_auth_params_for_tool(self, tool_name: str) -> dict[str, Any]:
 
     def get_default_auth_headers(self) -> dict[str, str]:
         """Get auth headers from default provider for transport authentication.
+
+        If no default provider is set, tries to use:
+        1. Provider named "api_key" (if exists)
+        2. First available provider (if only one exists)
+        3. Empty dict (if multiple providers and no default)
 
         Returns:
-            Dict of auth headers, or empty dict if no default provider is set
+            Dict of auth headers, or empty dict if no provider available
         """
+        # Use explicitly set default provider
         if self.default_provider and self.default_provider in self.auth_providers:
             return self.auth_providers[self.default_provider].get_auth_headers()
+
+        # Fallback: if only one provider exists, use it
+        if len(self.auth_providers) == 1:
+            provider = next(iter(self.auth_providers.values()))
+            return provider.get_auth_headers()
+
+        # Fallback: prefer "api_key" provider if it exists
+        if "api_key" in self.auth_providers:
+            return self.auth_providers["api_key"].get_auth_headers()
+
         return {}

mcp_fuzzer/client/main.py

@@ -136,9 +136,11 @@ def __init__(self, protocol, endpoint, timeout):
                         config["tool"], runs=config.get("runs", 10)
                     )
                 else:
+                    logging.debug(f"Calling fuzz_all_tools with runs={config.get('runs', 10)}")
                     tool_results = await client.fuzz_all_tools(
                         runs_per_tool=config.get("runs", 10)
                     )
+                    logging.debug(f"fuzz_all_tools completed, got {len(tool_results)} tool results")
         elif mode == "protocol":
             await _run_spec_guard_if_enabled(client, config, reporter)
             if config.get("protocol_type"):

mcp_fuzzer/client/tool_client.py

@@ -233,8 +233,12 @@ async def fuzz_all_tools(
         tool_timeout: float | None = None,
     ) -> dict[str, dict[str, Any]]:
         """Fuzz all tools from the server."""
+        self._logger.debug(f"fuzz_all_tools called with runs_per_tool={runs_per_tool}, tool_timeout={tool_timeout}")
+        self._logger.info("Fetching tools from server...")
         tools = await self._get_tools_from_server()
+        self._logger.debug(f"_get_tools_from_server returned {len(tools) if tools else 0} tools")
         if not tools:
+            self._logger.warning("No tools available for fuzzing")
             return {}
 
         all_results = {}

mcp_fuzzer/client/transport/auth_port.py

@@ -4,16 +4,36 @@
 from __future__ import annotations
 
 import argparse
+import os
 
 from ...auth import load_auth_config, setup_auth_from_env
 
 
 def resolve_auth_port(args: argparse.Namespace):
-    """Port for resolving authentication managers."""
+    """Port for resolving authentication managers.
+
+    Priority order:
+    1. --auth-config file (if provided)
+    2. --auth-env flag (if explicitly set)
+    3. Environment variables (if any auth vars are set, auto-detect)
+    4. None (no auth)
+    """
     if getattr(args, "auth_config", None):
         return load_auth_config(args.auth_config)
     if getattr(args, "auth_env", False):
         return setup_auth_from_env()
+
+    # Auto-detect: check if any auth environment variables are set
+    auth_env_vars = [
+        "MCP_API_KEY",
+        "MCP_USERNAME",
+        "MCP_PASSWORD",
+        "MCP_OAUTH_TOKEN",
+        "MCP_CUSTOM_HEADERS",
+    ]
+    if any(os.getenv(var) for var in auth_env_vars):
+        return setup_auth_from_env()
+
     return None