Set expectations for the first-run 401, and drop the docs tests

README.md

@@ -35,6 +35,11 @@ connection to populate its local tool-metadata cache, but it does not open an OA
 bootstrap cannot connect, Pi and the Render skills continue to work; authenticated MCP operations
 connect on demand.
 
+Because that bootstrap runs before you have credentials, the first session reports once that the
+Render server requires authentication (an HTTP 401). This is expected, not a failure — Pi and all
+21 skills load normally. Run `/mcp-auth render` when you want the Render tools, and the notice
+stops.
+
 ## Auth
 
 - **OAuth (recommended, interactive):** run `/mcp-auth render` in a session — no API key needed.

docs/SPEC.md

@@ -238,6 +238,12 @@ metadata cache does not exist, the first session makes a best-effort connection
 Failure is contained to MCP and MUST NOT prevent Pi or the Render skills from loading. Authenticated
 operations connect on demand after that bootstrap.
 
+The bootstrap is unconditional and the adapter exposes no setting to suppress it, so on a clean run
+with no credentials it reports an HTTP 401 once. `settings.autoAuth` stays at its default of `false`,
+which is what keeps that from escalating into an unprompted browser flow. `README.md` MUST set this
+expectation, because a first-run 401 that looks like breakage is the difference between an install
+users trust and one they abandon.
+
 `RENDER_API_KEY` MUST be passed by environment variable reference (`bearerTokenEnv`), never
 inlined as a literal. This package checks only whether a non-empty value is present to select the
 auth mode; the adapter resolves the value when connecting, so the secret never enters the config