docs: Update CLAUDE.md with new tray-core communication environment variables and API key management details

Author: Dumbris

CLAUDE.md

@@ -355,6 +355,12 @@ MCPProxy supports several environment variables for configuration and security:
 - `MCPPROXY_DISABLE_OAUTH` - Disable OAuth for testing
 - `HEADLESS` - Run in headless mode (no browser launching)
 
+**Tray-Core Communication**:
+- `MCPPROXY_API_KEY` - Shared API key for tray-core authentication (auto-generated if not set)
+- `MCPPROXY_TLS_ENABLED` - Enable TLS/HTTPS for both tray and core (automatically passed through)
+- `MCPPROXY_TRAY_SKIP_CORE` - Skip core launch in tray app (for development)
+- `MCPPROXY_CORE_URL` - Custom core URL for tray to connect to
+
 **Examples**:
 ```bash
 # Start with custom network binding
@@ -504,6 +510,16 @@ open "http://127.0.0.1:8080/ui/?apikey=your-api-key"
 - **Optional protection**: Empty API key disables authentication (useful for testing)
 - **Protected endpoints**: `/api/v1/*` and `/events` (SSE) require authentication when enabled
 
+#### Tray-Core API Key Coordination
+The tray application ensures secure communication with the core process through coordinated API key management:
+
+1. **Environment Variable Priority**: If `MCPPROXY_API_KEY` is set, both tray and core use the same key
+2. **Auto-Generation**: If no API key is provided, tray generates one and passes it to core via environment
+3. **Core Process Environment**: Tray always passes `MCPPROXY_API_KEY` to the core process it launches
+4. **TLS Configuration**: When `MCPPROXY_TLS_ENABLED=true`, it's automatically passed to the core process
+
+This prevents the "API key auto-generated for security" mismatch that would prevent tray-core communication.
+
 ### Quarantine System
 - **All new servers** added via LLM tools are automatically quarantined
 - **Quarantined servers** cannot execute tools until manually approved

cmd/mcpproxy-tray/main.go

@@ -118,10 +118,10 @@ func main() {
 	// Setup API key for secure communication between tray and core
 	if trayAPIKey == "" {
 		// Check environment variable first (for consistency with core behavior)
-		if envAPIKey := os.Getenv("MCPP_API_KEY"); envAPIKey != "" {
+		if envAPIKey := os.Getenv("MCPPROXY_API_KEY"); envAPIKey != "" {
 			trayAPIKey = envAPIKey
 			logger.Info("Using API key from environment variable for tray-core communication",
-				zap.String("api_key_source", "MCPP_API_KEY environment variable"),
+				zap.String("api_key_source", "MCPPROXY_API_KEY environment variable"),
 				zap.String("api_key_prefix", maskAPIKey(trayAPIKey)))
 		} else {
 			trayAPIKey = generateAPIKey()
@@ -887,18 +887,23 @@ func (cpl *CoreProcessLauncher) handleShutdown() {
 func (cpl *CoreProcessLauncher) buildCoreEnvironment() []string {
 	env := os.Environ()
 
-	// Filter out any existing MCPP_API_KEY to avoid conflicts
+	// Filter out any existing MCPPROXY_API_KEY to avoid conflicts
 	filtered := make([]string, 0, len(env))
 	for _, envVar := range env {
-		if !strings.HasPrefix(envVar, "MCPP_API_KEY=") {
+		if !strings.HasPrefix(envVar, "MCPPROXY_API_KEY=") {
 			filtered = append(filtered, envVar)
 		}
 	}
 
 	// Add our environment variables
 	filtered = append(filtered,
-		"MCPP_ENABLE_TRAY=false",
-		fmt.Sprintf("MCPP_API_KEY=%s", trayAPIKey))
+		"MCPPROXY_ENABLE_TRAY=false",
+		fmt.Sprintf("MCPPROXY_API_KEY=%s", trayAPIKey))
+
+	// Pass through TLS configuration if set
+	if tlsEnabled := strings.TrimSpace(os.Getenv("MCPPROXY_TLS_ENABLED")); tlsEnabled != "" {
+		filtered = append(filtered, fmt.Sprintf("MCPPROXY_TLS_ENABLED=%s", tlsEnabled))
+	}
 
 	return filtered
 }