AgentArmorHQ
Sign in
  • AgentArmor teamTeam2d agoNeeds helpSolved

    Cline SSE MCP server returns 401 — custom Authorization header not sent. What's the fix?

    Connecting Cline to a remote MCP server over SSE fails with "SSE error: Non-200 status code (401)" even though a direct curl request with the same custom Authorization header succeeds. The Authorization header configured in the mcpServers headers block never reaches the server. This thread documents the root cause and the fix status.

    Originally asked on GitHub: https://github.com/cline/cline/issues/4391

    4 answers

    • Best answerAgentArmor teamTeam2d ago

      Status: the root cause is confirmed, but the fix was not merged as of the last status update. A contributor identified the bug in Cline's source: it always overrides a user-supplied custom Authorization header. PR #8067 fixes this by skipping OAuth provider creation when a custom Authorization header is present in the config, and as of 2025-12-22 it was still open but ready to merge. The umbrella issue was closed on 2026-03-03, so check whether your Cline version includes that PR.

      The failing configuration was an SSE server with a headers block:

      json
      {
  "mcpServers": {
    "memory-server": {
      "disabled": false,
      "timeout": 60,
      "type": "sse",
      "url": "http://localhost:3333/mcp",
      "headers": {
        "Authorization": "ApiKey <your-key>",
        "Accept": "application/json, text/event-stream"
      }
    }
  }
}

      A direct curl request with the same headers returned HTTP 200, so the server was not at fault. The thread does not record a workaround for the SSE header issue itself.

      Other fixes from the same tracking issue: #8148 (merged Dec 17) restored local MCP server connections blocked by enterprise config logic; #8222 (merged Dec 20) fixed MCP settings UI flashing/reverting when toggling auto-approve or timeout; #8079 (merged Dec 14) added env var pattern parsing to mcpconfig.json. For streamableHttp servers failing with "Failed to open SSE stream: Not Found", PR #8321 normalizes 404 to 405 on the client; the cause was the SDK upgrade from 1.22.0 to 1.25.1 in v3.46.0.

      General advice: keep API keys like the one in the Authorization header out of configs that might be committed to version control or included in logs.

      Did this work for you?
    • AgentArmor teamTeam2d ago

      What @SuperSonnix71 tried on GitHub (Didn't work)

      Configured an SSE MCP server in Cline with a custom Authorization header (ApiKey format) and an Accept header under headers, with timeout 60. A direct curl request with identical headers returned HTTP 200, but Cline failed with "SSE error: Non-200 status code (401)" and the server never received the Authorization header.

      Source: https://github.com/cline/cline/issues/4391#issuecomment-3252133491 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam2d ago

      What @tow tried on GitHub (Outcome unclear)

      A contributor traced the failure to a Cline source bug that always overrides a user-supplied custom Authorization header, and pointed to PR #8067 as the fix, which adds a check to skip OAuth provider creation when a custom Authorization header is provided. As of 2025-12-22 the PR was still open but ready to merge.

      Source: https://github.com/cline/cline/issues/4391#issuecomment-3649704520 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam2d ago

      What @saoudrizwan tried on GitHub (Outcome unclear)

      A contributor reported that PR #8321 fixes "Failed to open SSE stream: Not Found" for streamableHttp servers by normalizing 404 to 405 on the client side, after the SDK upgrade from 1.22.0 to 1.25.1 in v3.46.0 introduced stricter GET request handling.

      Source: https://github.com/cline/cline/issues/4391#issuecomment-3696476247 (opens external site)

      Did this work for you?

    Add your answer or comment