From the Volleyland: a multiplayer learning game architecture map
Production deploys start closed: token required, MCP off, answer keys withheld from readers
strength · low · verified
Compose refuses to start the server without ADMIN_TOKEN, sets MCP_ACCESS to off, and the image sets NODE_ENV=production. Caddy forwards only /api, /ws and the web app, so the health probe stays inside the Compose network. If MCP is later opened read-only, list_questions and get_question strip the answer key for read-only callers.
These defaults only hold for the Compose path. Running the built server any other way skips them, which is why the development defaults above matter.