Add tk.* guard, HttpPipeline DI, and hosted-endpoint docs for token elicitation

- Reject token creation up front when the server's access token is a
  temporary tk.* token (used by the hosted MCP endpoint), instead of
  letting the Mapbox API round-trip fail. The elicitation dialog now
  omits "create"/"auto-create" in that case and only offers "provide
  an existing token".
- Move token-listing/creation off raw fetch() onto the shared
  HttpPipeline (constructor-injected httpRequest), consistent with
  other Mapbox API tools.
- Document the hosted-endpoint limitation in README and CHANGELOG.

Author: mattpodwysocki

CHANGELOG.md

@@ -1,5 +1,14 @@
 ## Unreleased
 
+### New Features
+
+- **Secure token elicitation for `preview_style_tool` / `style_comparison_tool`** (#57): `accessToken` is now optional on both tools. When omitted, the tool uses MCP elicitation to ask for a public token instead — either pasting an existing `pk.*` token, creating a new one with optional URL restrictions, or auto-creating a minimally-scoped one (`styles:read`, `styles:tiles`, `fonts:read`). This keeps your server's `sk.*`/`pk.*` access token out of chat history and preview URLs. Falls back to requiring `accessToken` directly on clients without elicitation support (Claude Desktop, Claude Code). A chosen/created token is cached in memory per account for the session; pass `useCustomToken: true` to force re-selection.
+  - On servers authenticated with a temporary `tk.*` token — notably the hosted MCP endpoint — Mapbox's Tokens API cannot create new tokens, so the "create a new token" and "auto-create" options are automatically omitted from the elicitation dialog rather than being offered and failing.
+
+### Changed
+
+- **`preview_style_tool` / `style_comparison_tool`**: token-listing and token-creation HTTP calls now go through the shared `HttpPipeline` (constructor-injected `httpRequest`) instead of a bare `fetch`, consistent with the rest of the API-calling tools.
+
 ## 0.8.2 - 2026-07-30
 
 ### Fixed

README.md

@@ -69,6 +69,8 @@ Get started by integrating with your preferred AI development environment:
 - **Claude Desktop**: ⚠️ Not yet supported (Claude will fall back to creating tokens via chat)
 - **Claude Code**: ⚠️ Not yet supported (provide `accessToken` parameter directly)
 
+**Note on the hosted MCP endpoint**: even on a client with full elicitation support, the [hosted endpoint](#hosted-mcp-endpoint) only offers **"I have a token to provide"** — see below for why.
+
 ### DXT Package Distribution
 
 This MCP server can be packaged as a DXT (Desktop Extension) file for easy distribution and installation. DXT is a standardized format for distributing local MCP servers, similar to browser extensions.
@@ -105,6 +107,13 @@ For quick access, you can use our hosted MCP endpoint:
 
 For detailed setup instructions for different clients and API usage, see the [Hosted MCP Server Guide](https://github.com/mapbox/mcp-server/blob/main/docs/hosted-mcp-guide.md). Note: This guide references the standard MCP endpoint - you'll need to update the endpoint URL to use the devkit endpoint above.
 
+**Token creation is unavailable on the hosted endpoint**: the hosted server authenticates each request with a short-lived, per-session token (`tk.*`), not your own Mapbox account token. Mapbox's Tokens API never grants `tokens:write` to a `tk.*` token, so it cannot be used to create new tokens. As a result, on the hosted endpoint:
+
+- `preview_style_tool` / `style_comparison_tool`'s elicitation dialog only offers **"I have a token to provide"** — the "create a new token" and "auto-create" options are hidden automatically, rather than being offered and then failing.
+- `create_token_tool` will fail with a permissions error if called directly.
+
+Paste an existing public token (`pk.*`, with `styles:read` scope) when prompted, or create one ahead of time from your [Mapbox Account page](https://account.mapbox.com/). Running this server **locally** with your own `pk.*`/`sk.*` access token (which can carry `tokens:write`) restores all three elicitation options, including create and auto-create.
+
 ### Getting Your Mapbox Access Token
 
 **A Mapbox access token is required to use this MCP server.**
@@ -194,6 +203,7 @@ Complete set of tools for managing Mapbox styles via the Styles API:
     3. **Auto-create a basic token** - Let the tool create a simple preview token for you
   - **Goose**: ⚠️ Known bug - Form displays after timeout ([goose#6471](https://github.com/block/goose/issues/6471))
   - **Claude Desktop, Claude Code**: ⚠️ Not yet supported - Provide `accessToken` parameter directly, or Claude will intelligently offer to create a token for you using `create_token_tool`
+  - **Hosted MCP endpoint**: ⚠️ Only "provide an existing token" is offered, regardless of client — see [Token creation is unavailable on the hosted endpoint](#hosted-mcp-endpoint)
   - **Alternative**: Provide `accessToken` parameter directly for backward compatibility with any client
 - **Session Storage**: Your token choice is cached for the session, so you only need to provide it once (when elicitation is supported)
 - **Best Practice**: Use URL-restricted tokens to further limit token usage to specific domains. While public tokens in URLs are read-only, URL restrictions add an extra layer of security by ensuring tokens only work on your specified domains
@@ -216,6 +226,7 @@ Complete set of tools for managing Mapbox styles via the Styles API:
     3. **Auto-create a basic token** - Let the tool create a simple preview token for you
   - **Goose**: ⚠️ Known bug - Form displays after timeout ([goose#6471](https://github.com/block/goose/issues/6471))
   - **Claude Desktop, Claude Code**: ⚠️ Not yet supported - Provide `accessToken` parameter directly, or Claude will intelligently offer to create a token for you using `create_token_tool`
+  - **Hosted MCP endpoint**: ⚠️ Only "provide an existing token" is offered, regardless of client — see [Token creation is unavailable on the hosted endpoint](#hosted-mcp-endpoint)
   - **Alternative**: Provide `accessToken` parameter directly for backward compatibility with any client
 - **Session Storage**: Your token choice is cached for the session, so you only need to provide it once (when elicitation is supported)
 - **Best Practice**: Use URL-restricted tokens to further limit token usage to specific domains. While public tokens in URLs are read-only, URL restrictions add an extra layer of security by ensuring tokens only work on your specified domains

src/utils/tokenElicitation.ts

@@ -75,9 +75,9 @@ export async function elicitPreviewToken(
         .join('\n')
     : 'No existing public tokens found.';
 
-  const choices = canCreateTokens
-    ? (['provide', 'create', 'auto'] as const)
-    : (['provide'] as const);
+  const choices: TokenChoice[] = canCreateTokens
+    ? ['provide', 'create', 'auto']
+    : ['provide'];
   const choiceNames = canCreateTokens
     ? [
         'I have a token to provide',