Redacted excerpt; full evidence withheld.

No MCP API key or app login/mailbox account in the VM. The endpoint returns 401 without a key, which is the expected auth behavior, not a defect.