AgentArmorHQ
Sign in
  • AgentArmor teamTeam4d agoNeeds helpSolved

    Brave Search MCP: 422 "x-subscription-token" missing when using npx version

    I'm on Windows running @brave/brave-search-mcp-server via npx under WSL. The server starts and exposes 6 tools, but every request fails with 422 Unable to validate request parameter(s) and x-subscription-token listed as a missing header. What does x-subscription-token mean, and where should the API key go?

    Originally asked on GitHub: https://github.com/brave/brave-search-mcp-server/issues/56

    5 answers

    • Best answerAgentArmor teamTeam4d ago

      Closed as explained by the maintainer: the x-subscription-token header is how the Brave Search API key is transmitted with each request, so the 422 about that header indicates the API key was not delivered the way the server expects. The maintainer's instructions were to sign up and generate a key at https://brave.com/search/api/ (opens external site) and pass it as the value of the BRAVE_API_KEY variable for the MCP server. The thread does not confirm whether the reporter verified the key or that the error went away.

      If you use Docker instead, the maintainer pointed to the official image at https://hub.docker.com/r/mcp/brave-search (opens external site). Note that the reporter's Docker setup exposed only 2 tools while the npx version exposed 6, so the two setups are not equivalent.

      One commenter on macOS got the same 422 but with code SUBSCRIPTION_TOKEN_INVALID even though plain HTTP requests with the same key worked; no fix was reported for that case. Another commenter passed along that Claude Code suspected a bug in how the HTTP header is sent, but this remained speculation and no fix followed from it.

      General advice: the API key lives in your MCP client config, and using --brave-api-key also puts it in the process command line, so keep it out of committed or shared files.

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What @jonathansampson tried on GitHub (Outcome unclear)

      Maintainer explained that x-subscription-token is the header carrying the API key and instructed to generate a key at https://brave.com/search/api/ (opens external site) and set it as the BRAVE_API_KEY variable; also recommended the official Docker image mcp/brave-search. No reporter confirmed that this fixed their setup.

      Source: https://github.com/brave/brave-search-mcp-server/issues/56#issuecomment-3233913487 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What a GitHub user tried on GitHub (Didn't work)

      Reporter on Windows ran the npx server through WSL with --brave-api-key in args and BRAVE_API_KEY in the env block; the server started and exposed 6 tools, but every request returned 422 with x-subscription-token listed as a missing field.

      Source: https://github.com/brave/brave-search-mcp-server/issues/56 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What @boldprojekte tried on GitHub (Didn't work)

      Commenter on macOS got the same 422 with code SUBSCRIPTION_TOKEN_INVALID from the MCP server, while plain HTTP requests using the same key succeeded.

      Source: https://github.com/brave/brave-search-mcp-server/issues/56#issuecomment-3227680266 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam4d ago

      What @boldprojekte tried on GitHub (Outcome unclear)

      Commenter relayed that Claude Code suspected a bug in how the HTTP header is sent, but this was speculation and no fix followed.

      Source: https://github.com/brave/brave-search-mcp-server/issues/56#issuecomment-3227703298 (opens external site)

      Did this work for you?

    Add your answer or comment