AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam3d agoNeeds helpSolved

    MCP SSE server headers (authorization) never sent in Roo-Code

    In Roo-Code 3.12.2 (OpenAI provider, deepseek-chat), I added an SSE-based MCP server with key auth and set headers in mcp_setting.json, but the authorization header never reaches the server and the request fails with 401. Later versions up to at least 3.19.0 show the same behavior. How can custom headers be forwarded to an SSE MCP server?

    Originally asked on GitHub: https://github.com/RooCodeInc/Roo-Code/issues/2705

    6 answers

    • Best answerAgentArmorHQ teamTeam3d ago

      Fixed in Roo-Code 3.19.1 (PR #4148). The problem was not your config format — it was the SSE transport. JavaScript's EventSource API (used by the MCP TypeScript SDK) does not support custom headers, so the headers block in mcp_setting.json was silently dropped. The thread links modelcontextprotocol/typescript-sdk#436 as the root cause.

      The config that failed is the standard one:

      json
      "finance-tools-mcp": {
  "url": "http://localhost:3001/sse",
  "headers": {
    "authorization": "Bearer <token>"
  }
}

      With this config, the server only received host, accept, cache-control, etc. — no authorization header at all. A collaborator acknowledged the bug and opened a PR; a user who tested PR #4148 confirmed headers are now forwarded, and the fix shipped in 3.19.1. The solution is to upgrade Roo-Code to 3.19.1 or later. No verified workaround exists for older versions — an automated comment suggested the Yaffle EventSource polyfill, but nobody in the thread confirmed it works with Roo.

      General advice: this config stores a bearer token in mcp_setting.json, so treat that file as sensitive and keep it out of version control.

      Did this work for you?
    • AgentArmorHQ teamTeam3d ago

      What @fabriciojoc tried on GitHub (Worked)

      User tested PR #4148 inside Roo and reported that headers are now forwarded to the MCP server correctly.

      Source: https://github.com/RooCodeInc/Roo-Code/issues/2705#issuecomment-2923266048 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam3d ago

      What @wanghsinche tried on GitHub (Didn't work)

      User reproduced the bug with a local SSE server at localhost:3001 and the same headers config; the received request headers contained no authorization field.

      Source: https://github.com/RooCodeInc/Roo-Code/issues/2705#issuecomment-2910269361 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam3d ago

      What @kenneth-bro tried on GitHub (Didn't work)

      Original report in Roo-Code 3.12.2: added an SSE MCP server with key auth, configured headers in mcp_setting.json, and observed the headers were not applied.

      Source: https://github.com/RooCodeInc/Roo-Code/issues/2705 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam3d ago

      What @dosubot tried on GitHub (Outcome unclear)

      An automated (Dosu) comment suggested using the Yaffle EventSource polyfill to add custom header support for SSE connections.

      Source: https://github.com/RooCodeInc/Roo-Code/issues/2705#issuecomment-2812313603 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam3d ago

      What @fabriciojoc tried on GitHub (Didn't work)

      User confirmed the same MCP server config works outside Roo but headers are still not forwarded inside Roo.

      Source: https://github.com/RooCodeInc/Roo-Code/issues/2705#issuecomment-2923112269 (opens external site)

      Did this work for you?

    Add your answer or comment