diff --git a/tests/test_main.py b/tests/test_main.py
new file mode 100644
index 0000000..021381d
--- /dev/null
+++ b/tests/test_main.py
@@ -0,0 +1,73 @@
+from fastapi.testclient import TestClient
+
+
+def test_app_health_reports_status(monkeypatch):
+    from axon.services.cache import InMemoryCache
+
+    cache = InMemoryCache()
+
+    async def async_cache():
+        return cache
+
+    monkeypatch.setattr("axon.main.get_cache", async_cache)
+    monkeypatch.setattr("axon.main.load_reranker", lambda: None)
+    monkeypatch.setattr("axon.main.get_reranker", lambda: object())
+    monkeypatch.setattr("axon.middleware.auth.settings.api_keys", None)
+
+    from axon.main import app
+
+    with TestClient(app) as client:
+        resp = client.get("/health")
+
+    assert resp.status_code == 200
+    assert resp.json() == {
+        "status": "ok",
+        "redis": "in-memory fallback",
+        "reranker": "loaded",
+    }
+
+
+def test_app_includes_core_routes(monkeypatch):
+    monkeypatch.setattr("axon.main.load_reranker", lambda: None)
+    monkeypatch.setattr("axon.middleware.auth.settings.api_keys", None)
+
+    from axon.main import app
+
+    paths = set(app.openapi()["paths"])
+    assert "/search" in paths
+    assert "/extract" in paths
+    assert "/crawl" in paths
+    assert "/map" in paths
+    assert "/ingest" in paths
+    assert "/index/search" in paths
+    assert "/research/jobs" in paths
+    assert "/tavily/search" in paths
+    assert "/validate/citations" in paths
+    assert "/research" in paths
+    assert "/health" in paths
+    assert "/metrics" in paths
+
+
+def test_app_auth_middleware_protects_routes(monkeypatch):
+    monkeypatch.setattr("axon.main.load_reranker", lambda: None)
+    monkeypatch.setattr("axon.middleware.auth.settings.api_keys", "secret")
+
+    from axon.main import app
+
+    with TestClient(app) as client:
+        resp = client.post("/search", json={"query": "test"})
+
+    assert resp.status_code == 401
+
+
+def test_metrics_endpoint_exempt_from_auth(monkeypatch):
+    monkeypatch.setattr("axon.main.load_reranker", lambda: None)
+    monkeypatch.setattr("axon.middleware.auth.settings.api_keys", "secret")
+
+    from axon.main import app
+
+    with TestClient(app) as client:
+        resp = client.get("/metrics")
+
+    assert resp.status_code == 200
+    assert "requests_total" in resp.json()