Confirm Authorization headers reach your MCP server through Inspector

Why it matters

In a closed MCP Inspector issue about OAuth in v0.16.8 and v0.16.9 (opens external site) ↗, the reporter said the server received an Authorization header containing only "Bearer" with no access token, so authenticated requests returned 401 even though the OAuth flow appeared to complete. A maintainer suspected a placeholder Authorization header had been added automatically, and in another reply identified an invalid header name as the cause. Checking what the server actually receives helps separate client-side header problems from server-side auth bugs.

Steps

1. Upgrade MCP Inspector to v0.17.0. A maintainer reported that this version seemed to work fine. The reporter also said pinning to v0.16.7 resolved the problem for them, so use that pin only if you cannot upgrade.
2. Open the custom headers UI introduced in v0.16.8 and look for an Authorization entry you did not add. The maintainer suspected a placeholder header was added automatically, so remove or disable it and retry the request.
3. Make sure the header name is exactly Authorization. A maintainer pointed out that HTTP_AUTHORIZATION is a server-side variable name used by PHP/Apache after it converts an incoming header, not a header a client should send.
4. Before retrying OAuth, open your browser devtools and clear the saved local and session storage for the Inspector host. The maintainer asked the reporter to do this for localhost:6474. This also removes saved OAuth state, so you will need to log in again.
5. Confirm on the server side. Log whether an Authorization header arrived, along with its length or a masked prefix, then check that a request to a protected endpoint succeeds rather than returning 401. Do not log the full token.
6. If you need headers in a config file for CLI mode, the original request in issue #420 (opens external site) ↗ asked for a headers object inside the server entry. The example there used array syntax, which is not valid JSON, so ask for an object of name/value pairs. The thread links PR #716 as the implementation but does not show the final merged syntax, so check that PR or the current README for exact key names.

Common mistakes

• Assuming a 401 means the server rejects a good token, when the header is empty or misnamed on the client side.
• Using HTTP_AUTHORIZATION as a header name in Inspector. That is a server variable name, not a header you send.
• Pasting a real bearer token into a committed config file. Prefer an environment variable or a secret manager where the tool supports it.
• Forgetting that clearing browser storage removes saved OAuth state, so login has to be repeated.