claude-code - 💡(How to fix) Fix Streamable HTTP MCP: headers and headersHelper not sent with requests [2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#48514Fetched 2026-04-16 06:58:04
View on GitHub
Comments
2
Participants
3
Timeline
6
Reactions
0
Author
Timeline (top)
labeled ×4commented ×2

Code Example

{
  "mcpServers": {
    "my-server": {
      "type": "http",
      "url": "https://example.com/api/v4.0/mcp",
      "headersHelper": "./get-token.sh"
    }
  }
}

---

{
  "mcpServers": {
    "my-server": {
      "type": "http",
      "url": "https://example.com/api/v4.0/mcp",
      "headers": {
        "Authorization": "Bearer <valid-token>"
      }
    }
  }
}
RAW_BUFFERClick to expand / collapse

Bug Description

When using a Streamable HTTP MCP server ("type": "http") with either headers or headersHelper in .mcp.json, Claude Code does not attach the configured headers to the HTTP requests it sends to the MCP endpoint.

Reproduction

.mcp.json config (tried both variants):

With headersHelper:

{
  "mcpServers": {
    "my-server": {
      "type": "http",
      "url": "https://example.com/api/v4.0/mcp",
      "headersHelper": "./get-token.sh"
    }
  }
}

With static headers:

{
  "mcpServers": {
    "my-server": {
      "type": "http",
      "url": "https://example.com/api/v4.0/mcp",
      "headers": {
        "Authorization": "Bearer <valid-token>"
      }
    }
  }
}

Steps to reproduce:

  1. Configure an HTTP MCP server that requires Bearer token auth (validated at the gateway before reaching the MCP handler)
  2. Run /mcp to connect
  3. Call any tool

Expected behavior:

The Authorization header from headers/headersHelper should be included in every HTTP POST to the MCP endpoint.

Actual behavior:

The request reaches the server without the Authorization header, resulting in a 403 from the auth gateway.

Verification:

  • The same token works when calling the endpoint directly via curl or Postman
  • The headersHelper script produces valid output: {"Authorization": "Bearer eyJ..."}
  • Server-side logs confirm the request never reaches the MCP handler (blocked at the auth gateway layer)
  • Both headers and headersHelper configurations exhibit the same behavior

Environment

  • macOS (Darwin 24.6.0)
  • Claude Code CLI

🤖 Generated with Claude Code

extent analysis

TL;DR

The issue can be resolved by verifying the implementation of the headersHelper script and the headers configuration in the .mcp.json file to ensure they are correctly attaching the Authorization header to HTTP requests.

Guidance

  • Review the get-token.sh script to ensure it is correctly outputting the Authorization header in the expected format.
  • Verify that the headers configuration in the .mcp.json file is correctly formatted and that the token is valid.
  • Check the Claude Code CLI documentation to ensure that the headersHelper and headers configurations are supported and correctly implemented.
  • Test the headersHelper script and headers configuration with a tool like curl or Postman to verify that the Authorization header is being attached correctly.

Example

No code snippet is provided as the issue is related to the configuration and implementation of the headersHelper script and headers configuration.

Notes

The issue may be related to the implementation of the headersHelper script or the headers configuration in the .mcp.json file. Further investigation is needed to determine the root cause of the issue.

Recommendation

Apply workaround: Verify and correct the implementation of the headersHelper script and headers configuration to ensure they are correctly attaching the Authorization header to HTTP requests. This is because the issue is likely related to the configuration and implementation of these components, and correcting them should resolve the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING