stacklok / toolhive / 27573625761

67%

Build Type

push

github

Committed by web-flow

Commit Message

Add passthroughHeaders to VirtualMCPServer for header forwarding (#5466)

When a client calls vMCP with a header its backend needs — e.g. x-mcp-api-key that the backend resolves to a specific user — vMCP silently drops it. vMCP opens a fresh request to each backend and sends only its own headers, so the caller's header never arrives. Backends that authenticate per-user from a header therefore can't be used through vMCP today — only by hitting the backend directly.

This adds spec.passthroughHeaders: an allowlist of incoming header names that vMCP forwards, unchanged, to every backend it calls.

spec:
  passthroughHeaders:
    - x-mcp-api-key
A listed header is read from the client request and attached to that session's backend requests. Headers not listed are ignored. Restricted names (Host, Authorization, X-Forwarded-*, hop-by-hop) are rejected.

Approach discussed and agreed with @jerm-dro on #3958 (assigned to me there).

Closes #3958

Coverage Stats

151 of 158 new or added lines in 11 files covered. (95.57%)

2 existing lines in 1 file now uncovered.

68493 of 102685 relevant lines covered (66.7%)

61.63 hits per line