## Problem The `mcp_server.handle` route uses `_permission: 'access mcp server'` combined with `_auth: ['cookie']`. An unauthenticated MCP client (one that has not established a Drupal session cookie) never reaches the controller — Drupal's routing/access layer denies the request and returns an HTML (or framework-rendered JSON) 403 page. MCP clients cannot parse a Drupal 403 error page. They expect a JSON-RPC 2.0 error object, ideally with HTTP 401 and a `WWW-Authenticate` header so they know to authenticate. ## Expected behaviour The route should use `_access: 'TRUE'` and the controller should explicitly check for anonymous users and return a proper JSON-RPC 2.0 error with HTTP 401 / `WWW-Authenticate: Bearer` before attempting `$server->run()`. The controller already has `McpAuthorizationDeniedException` handling for tool/resource-level auth — the same pattern should cover the unauthenticated-request case. ## Steps to reproduce 1. Send a `POST /_mcp` initialize request with no session cookie and no credentials. 2. Observe Drupal's HTML/framework 403 response instead of a JSON-RPC error. --- _This issue was identified with the assistance of Claude (Anthropic) while integrating `drupal/mcp_server` into a Drupal distribution._