AgentArmorHQ
Sign in
  • AgentArmor teamTeam2d agoNeeds helpSolved

    Cline MCP: custom Authorization header not sent to remote MCP server

    With Cline 3.13.1 on macOS, a remote MCP server configured with an Authorization header in its headers block still receives requests without that header, resulting in a 401. A later report on Cline 3.16.2 showed the same behavior with tcpdump. How can custom headers such as a Bearer token reach an MCP server?

    Originally asked on GitHub: https://github.com/cline/cline/issues/3090

    5 answers

    • Best answerAgentArmor teamTeam2d ago

      Status: closed as completed. One commenter reports that custom headers work in the latest Cline release for streamable HTTP MCP servers. Another commenter later said they could not get that transport working, so verify it against your own server.

      What the thread established:

      1. The header is dropped on the SSE transport. In Cline 3.16.2, a tcpdump against a Home Assistant SSE MCP server showed Cline sending its own defaults (user-agent: node, accept-language: *, sec-fetch-mode: cors, and others) while the configured Authorization: Bearer ... header was missing, which produced a 401. A curl request with the same Authorization header reached the same server, so the server configuration was not the cause.

      2. Root cause and workarounds. Commenters link cline/cline#2926 as the source of the root cause, a workaround in modelcontextprotocol/typescript-sdk#436, and huggingface.js PR #1422, which bypasses the issue in that library. The thread does not state that a fix was merged at the SDK layer.

      3. Reported config for streamable HTTP in the latest release, using the renamed type field:

      json
      {
  "mcpServers": {
    "quip-http": {
      "disabled": false,
      "timeout": 60,
      "type": "streamableHttp",
      "url": "https://id.execute-api.us-west-2.amazonaws.com/prod/mcp",
      "headers": {
        "X-API-KEY": "..."
      }
    }
  }
}

      General advice: Bearer tokens in mcp.json are stored in plaintext, so keep that file out of shared repositories.

      Did this work for you?
    • AgentArmor teamTeam2d ago

      What @lzeng579 tried on GitHub (Didn't work)

      Configured a remote MCP server with an Authorization header following the Roo docs in Cline 3.13.1 on macOS and observed that Cline did not attach the header to requests.

      Source: https://github.com/cline/cline/issues/3090 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam2d ago

      What @lenaxia tried on GitHub (Didn't work)

      In Cline 3.16.2, added Authorization, Accept, and User-Agent headers in mcp.json for a Home Assistant SSE server and captured traffic with tcpdump. The Authorization header was missing while Cline injected its own defaults; a curl request with the same Authorization header reached the server successfully.

      Source: https://github.com/cline/cline/issues/3090#issuecomment-2896536462 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam2d ago

      What @lenaxia tried on GitHub (Outcome unclear)

      Pointed to cline/cline#2926 for the root cause, to a workaround in modelcontextprotocol/typescript-sdk#436, and to huggingface.js PR #1422 as a bypass of the issue in that library.

      Source: https://github.com/cline/cline/issues/3090#issuecomment-2896543267 (opens external site)

      Did this work for you?
    • AgentArmor teamTeam2d ago

      What @zxkane tried on GitHub (Outcome unclear)

      Reported that the latest Cline release supports custom headers for streamable HTTP MCP servers using "type": "streamableHttp" plus a headers object, noting the type field was renamed.

      Source: https://github.com/cline/cline/issues/3090#issuecomment-2965216808 (opens external site)

      Did this work for you?

    Add your answer or comment