Make the HTTP dashboard server opt-in (or clearly logged) when running MCP over stdio

[illeatmyhat]

Current behavior

When evolve-mcp runs with the default stdio transport, it also starts the FastAPI dashboard/API server on 127.0.0.1:8000 in a background daemon thread:

• altk_evolve/frontend/mcp/__main__.py:85-90 — the stdio branch unconditionally spawns the API thread before mcp.run()
• altk_evolve/frontend/mcp/__main__.py:50-56 — run_api_server() binds uvicorn to 127.0.0.1:8000 with log_level="warning", so startup is effectively silent
• altk_evolve/frontend/mcp/mcp_server.py:41-45 — the FastAPI app mounts the full API router from frontend/api/routes.py

There is currently no flag or environment variable to disable it, and no authentication on the endpoints it exposes.

Why it matters

Users who launch the server over stdio (e.g. from an MCP client config) may not expect an HTTP listener to exist at all. Surprise listeners complicate deployment reviews, and any local process can read or modify entity data through the API. For pre-1.0 tooling this is a good moment to make the behavior explicit and predictable.

Suggested direction

• Make the HTTP dashboard/API server opt-in via a CLI flag and/or env var (e.g. --dashboard / EVOLVE_DASHBOARD=1), defaulting to off in stdio mode
• At minimum, log prominently at startup that the HTTP server is running and on which host/port
• When enabled, consider a simple shared-secret or localhost token so only intended clients (e.g. the bundled UI) use it