init

internal/handler/api.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"mmw-agent/internal/agent"
+	"mmw-agent/internal/config"
 )
 
 // APIHandler handles API requests from the master server (for pull mode)
@@ -86,8 +87,12 @@ func (h *APIHandler) ServeSpeedHTTP(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
-// authenticate checks if the request is authorized
+// authenticate checks if the request is authorized (token + User-Agent)
 func (h *APIHandler) authenticate(r *http.Request) bool {
+	if r.Header.Get("User-Agent") != config.AgentUserAgent {
+		return false
+	}
+
 	if h.configToken == "" {
 		return true
 	}

internal/handler/manage.go

@@ -13,6 +13,7 @@ import (
 	"strings"
 	"time"
 
+	"mmw-agent/internal/config"
 	"mmw-agent/internal/xrpc"
 
 	"github.com/xtls/xray-core/app/proxyman/command"
@@ -31,8 +32,12 @@ func NewManageHandler(configToken string) *ManageHandler {
 	}
 }
 
-// authenticate checks if the request is authorized
+// authenticate checks if the request is authorized (token + User-Agent)
 func (h *ManageHandler) authenticate(r *http.Request) bool {
+	if r.Header.Get("User-Agent") != config.AgentUserAgent {
+		return false
+	}
+
 	if h.configToken == "" {
 		return true
 	}