zai-org / zai-org/feedback

[MCP] type:"http" 的 MCP server 配置中自定义 header 名未被透传,仅标准 Authorization 生效 使用环境

Open
#45 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

priority: P2 status: 待评估 type: Bug
Dominant language
No language data
Stars
22
Forks
1
PR merge metrics
No merged PRs in 30d

Description

提交前确认 · Pre-submission checklist
  • 我已搜索过现有 issue,确认这不是重复 / I searched existing issues and confirmed this isn't a duplicate.
  • 我已阅读 CONTRIBUTING.md / I've read CONTRIBUTING.md.
问题类别 · Category

工具调用 / MCP · Tool use / MCP

涉及的 Agent 框架 · Agent framework

ZCode Agent(自研)

严重程度 · Severity

阻塞使用 · Blocking (无法使用核心功能 / core function unusable)

复现频率 · Reproducibility

必现 · Always

问题描述 · Description

[MCP] type:"http" 的 MCP server 配置中自定义 header 名未被透传,仅标准 Authorization 生效

复现步骤 · Steps to reproduce
  1. 在 ~/.zcode/cli/config.json 中配置一个 type: "http" 的 MCP server,使用非标准 header 名传鉴权信息:

json
"web-reader": {
"type": "http",
"url": "https://open.bigmodel.cn/api/mcp/web_reader/mcp",
"headers": {
"authorizationToken": "<API_KEY>"
}
}
2. 启动 / 重载 MCP,观察该 server 的连接状态。

期望表现 · Expected behavior

headers 中声明的自定义 header(如 authorizationToken)应被透传到目标 MCP 端点。该端点同时接受 Authorization: Bearer xxx 和 authorizationToken: xxx 两种鉴权头(已通过 curl 验证,均返回 200)

实际表现 · Actual behavior

自定义 header 未被发送,端点收到的是匿名请求,返回鉴权失败:

{"code":1001,"msg":"Header中未收到Authorization参数,无法进行身份验证。","success":false}

该响应不符合 JSON-RPC 2.0 schema,客户端报一连串 Zod 校验错误(unrecognized_keys: code,msg,success 等)。
工具列表显示 0 个工具,连接失败。

此外运行时拼接出的请求 URL 出现了 http://https://... 的畸形前缀(疑似第二个独立问题)。

ZCode 版本 · ZCode version

3.1.15

设备 / 系统 / 浏览器 · Device / OS / Browser

Windows11

截图 / 录屏 / 日志 · Screenshots / Recordings / Logs
Image

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The only concrete file named is ~/.zcode/cli/config.json; start by reproducing the HTTP MCP connection with the authorizationToken header and inspect the request-building path. Done means custom headers reach the endpoint and the URL no longer gains an http://https:// prefix, with the connection exposing its tools.

Written by the indexing model from the issue text.

Assessment

Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.