diff --git a/opax-mcp/server.py b/opax-mcp/server.py
index 664cd99..0602f90 100644
--- a/opax-mcp/server.py
+++ b/opax-mcp/server.py
@@ -66,7 +66,8 @@ logger.info(f"OLLAMA_BASE_URL: {OLLAMA_BASE_URL}")
 # ---------------------------------------------------------------------------
 
 async def _verify_auth(request: Request) -> None:
-    secret = os.getenv("MCPSECRET", "").strip()
+    secret = os.getenv("MCPSECRET") or os.getenv("MCP_SECRET", "")
+    secret = secret.strip()
     if not secret:
         logger.error("MCPSECRET is not configured on the server.")
         raise HTTPException(status_code=500, detail="MCPSECRET not configured")