- Update createMcpServer signature to accept (db, userId) - MCP auth middleware resolves userId from API key and Bearer token - Store userId alongside transport in session map - All 4 tool registration functions accept and pass userId - Collection summary resource passes userId to all service calls