From 821c7b31b600241e3f367fddefb1f67017c583c3 Mon Sep 17 00:00:00 2001
From: Kai Tanaka <275430420+quyentonndbs@users.noreply.github.com>
Date: Mon, 8 Jun 2026 20:57:31 +0000
Subject: [PATCH] chore: improve supermemory maintenance path

---
 apps/mcp/src/auth.test.ts | 15 +++++++++++++++
 apps/mcp/src/auth.ts      |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 apps/mcp/src/auth.test.ts

diff --git a/apps/mcp/src/auth.test.ts b/apps/mcp/src/auth.test.ts
new file mode 100644
index 000000000..cd03f9764
--- /dev/null
+++ b/apps/mcp/src/auth.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest"
+import { isApiKey } from "./auth"
+
+describe("isApiKey", () => {
+	it("returns true for keys with the sm_ prefix and length > 3", () => {
+		expect(isApiKey("sm_valid_key")).toBe(true)
+		expect(isApiKey("sm_123")).toBe(true)
+	})
+
+	it("returns false for the bare prefix or missing prefix", () => {
+		expect(isApiKey("sm_")).toBe(false)
+		expect(isApiKey("")).toBe(false)
+		expect(isApiKey("oauth_token")).toBe(false)
+	})
+})
diff --git a/apps/mcp/src/auth.ts b/apps/mcp/src/auth.ts
index 7bd3b9464..ed4e21e79 100644
--- a/apps/mcp/src/auth.ts
+++ b/apps/mcp/src/auth.ts
@@ -15,7 +15,7 @@ export interface AuthUser {
  * Check if a token is an API key (starts with "sm_")
  */
 export function isApiKey(token: string): boolean {
-	return token.startsWith("sm_")
+	return token.startsWith("sm_") && token.length > 3
 }
 
 /**