[MCP] type:"http" 的 MCP server 配置中自定义 header 名未被透传,仅标准 Authorization 生效 使用环境
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 22
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
提交前确认 · Pre-submission checklist
- 我已搜索过现有 issue,确认这不是重复 / I searched existing issues and confirmed this isn't a duplicate.
- 我已阅读 CONTRIBUTING.md / I've read CONTRIBUTING.md.
问题类别 · Category
工具调用 / MCP · Tool use / MCP
涉及的 Agent 框架 · Agent framework
ZCode Agent(自研)
严重程度 · Severity
阻塞使用 · Blocking (无法使用核心功能 / core function unusable)
复现频率 · Reproducibility
必现 · Always
问题描述 · Description
[MCP] type:"http" 的 MCP server 配置中自定义 header 名未被透传,仅标准 Authorization 生效
复现步骤 · Steps to reproduce
- 在 ~/.zcode/cli/config.json 中配置一个 type: "http" 的 MCP server,使用非标准 header 名传鉴权信息:
json
"web-reader": {
"type": "http",
"url": "https://open.bigmodel.cn/api/mcp/web_reader/mcp",
"headers": {
"authorizationToken": "<API_KEY>"
}
}
2. 启动 / 重载 MCP,观察该 server 的连接状态。
期望表现 · Expected behavior
headers 中声明的自定义 header(如 authorizationToken)应被透传到目标 MCP 端点。该端点同时接受 Authorization: Bearer xxx 和 authorizationToken: xxx 两种鉴权头(已通过 curl 验证,均返回 200)
实际表现 · Actual behavior
自定义 header 未被发送,端点收到的是匿名请求,返回鉴权失败:
{"code":1001,"msg":"Header中未收到Authorization参数,无法进行身份验证。","success":false}
该响应不符合 JSON-RPC 2.0 schema,客户端报一连串 Zod 校验错误(unrecognized_keys: code,msg,success 等)。
工具列表显示 0 个工具,连接失败。
此外运行时拼接出的请求 URL 出现了 http://https://... 的畸形前缀(疑似第二个独立问题)。
ZCode 版本 · ZCode version
3.1.15
设备 / 系统 / 浏览器 · Device / OS / Browser
Windows11
截图 / 录屏 / 日志 · Screenshots / Recordings / Logs
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The only concrete file named is ~/.zcode/cli/config.json; start by reproducing the HTTP MCP connection with the authorizationToken header and inspect the request-building path. Done means custom headers reach the endpoint and the URL no longer gains an http://https:// prefix, with the connection exposing its tools.
Written by the indexing model from the issue text.
Assessment
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100