diff --git a/cmd/mcp/mcp.go b/cmd/mcp/mcp.go
index 984cc0403e4231e1e56c57869a15b27e198d4327..f7e74180268add74d5a93f081b7bfb3871b959fd 100644
--- a/cmd/mcp/mcp.go
+++ b/cmd/mcp/mcp.go
@@ -8,7 +8,6 @@ package mcp
 import (
 	"errors"
 	"fmt"
-	"os"
 
 	"git.secluded.site/lune/internal/client"
 	"git.secluded.site/lune/internal/config"
@@ -88,10 +87,9 @@ func runMCP(cmd *cobra.Command, _ []string) error {
 		return err
 	}
 
-	// Try keyring first, fall back to env var if keyring fails or is empty
-	token, _ := client.GetToken() // ignore keyring errors (e.g., no dbus in containers)
-	if token == "" {
-		token = os.Getenv("LUNE_ACCESS_TOKEN")
+	token, err := client.GetToken()
+	if err != nil {
+		return err
 	}
 
 	if token == "" {
diff --git a/internal/client/client.go b/internal/client/client.go
index 0d0bc25a026055ce9604162e04350348a555b3ef..e81f000c7076b4b641dd486337fa1760bd956a9c 100644
--- a/internal/client/client.go
+++ b/internal/client/client.go
@@ -8,6 +8,7 @@ package client
 import (
 	"errors"
 	"fmt"
+	"os"
 	"runtime/debug"
 
 	"git.secluded.site/go-lunatask"
@@ -19,26 +20,33 @@ const (
 	keyringUser    = "api-key"
 )
 
-// ErrNoToken indicates no access token is available in the system keyring.
-var ErrNoToken = errors.New("no access token found in system keyring; run 'lune init' to configure")
+// ErrNoToken indicates no access token is available.
+var ErrNoToken = errors.New("no access token found; set LUNE_ACCESS_TOKEN or run 'lune init' to configure")
 
-// New creates a Lunatask client using the access token from system keyring.
+// New creates a Lunatask client using the access token from LUNE_ACCESS_TOKEN
+// environment variable or system keyring. Environment variable takes precedence.
 func New() (*lunatask.Client, error) {
-	token, err := keyring.Get(keyringService, keyringUser)
+	token, err := GetToken()
 	if err != nil {
-		if errors.Is(err, keyring.ErrNotFound) {
-			return nil, ErrNoToken
-		}
+		return nil, err
+	}
 
-		return nil, fmt.Errorf("accessing system keyring: %w", err)
+	if token == "" {
+		return nil, ErrNoToken
 	}
 
 	return lunatask.NewClient(token, lunatask.UserAgent("lune/"+version())), nil
 }
 
-// GetToken returns the access token from keyring. Returns empty string and nil error
-// if not found; returns error for keyring access problems.
+// GetToken returns the access token from LUNE_ACCESS_TOKEN environment variable
+// or keyring. Returns empty string and nil error if not found in either location;
+// returns error for keyring access problems. Environment variable takes precedence.
 func GetToken() (string, error) {
+	// Env var takes precedence for explicit override
+	if token := os.Getenv("LUNE_ACCESS_TOKEN"); token != "" {
+		return token, nil
+	}
+
 	token, err := keyring.Get(keyringService, keyringUser)
 	if err != nil {
 		if errors.Is(err, keyring.ErrNotFound) {
diff --git a/internal/mcp/tools/timestamp/handler.go b/internal/mcp/tools/timestamp/handler.go
index 933525f9f06b26e212158bb6f9c00d6c23596d42..d60a32256b81f382142d2b9850cdfd3524e6feff 100644
--- a/internal/mcp/tools/timestamp/handler.go
+++ b/internal/mcp/tools/timestamp/handler.go
@@ -27,9 +27,9 @@ Empty input returns today.`
 // ToolAnnotations returns hints about tool behavior.
 func ToolAnnotations() *mcp.ToolAnnotations {
 	return &mcp.ToolAnnotations{
-		ReadOnlyHint:    true,
-		OpenWorldHint:   ptr(true),
-		Title:           "Parse date",
+		ReadOnlyHint:  true,
+		OpenWorldHint: ptr(true),
+		Title:         "Parse date",
 	}
 }