fix(mcp-apps-middleware): forward auth headers to HTTP and SSE transports (#1862)#1966
Open
NathanTarbert wants to merge 6 commits into
Open
fix(mcp-apps-middleware): forward auth headers to HTTP and SSE transports (#1862)#1966NathanTarbert wants to merge 6 commits into
NathanTarbert wants to merge 6 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Python Preview PackagesVersion
Install with uvAdd the TestPyPI index to your [[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
explicit = trueThen install the packages you need: # Core SDK
uv add 'ag-ui-protocol==0.0.0.dev1784136172' --index testpypi
# Integrations (each already depends on the matching ag-ui-protocol preview)
uv add 'ag-ui-langgraph==0.0.0.dev1784136172' --index testpypi
uv add 'ag-ui-crewai==0.0.0.dev1784136172' --index testpypi
# NOTE: ag-ui-agent-spec depends on pyagentspec (git-only, not on PyPI).
# You will need to install pyagentspec separately from its git repo.
uv add 'ag-ui-agent-spec==0.0.0.dev1784136172' --index testpypi
uv add 'ag_ui_adk==0.0.0.dev1784136172' --index testpypi
uv add 'ag_ui_strands==0.0.0.dev1784136172' --index testpypiInstall with pippip install \
--index-url https://test.pypi.org/simple/ \
--extra-index-url https://pypi.org/simple/ \
ag-ui-protocol==0.0.0.dev1784136172
Commit: 853917e |
@ag-ui/a2a-middleware
@ag-ui/a2ui-middleware
@ag-ui/event-throttle-middleware
@ag-ui/mcp-apps-middleware
@ag-ui/mcp-middleware
@ag-ui/a2a
@ag-ui/adk
@ag-ui/ag2
@ag-ui/agno
@ag-ui/aws-strands
@ag-ui/claude-agent-sdk
@ag-ui/crewai
@ag-ui/langchain
@ag-ui/langgraph
@ag-ui/llamaindex
@ag-ui/mastra
@ag-ui/pydantic-ai
@ag-ui/vercel-ai-sdk
@ag-ui/watsonx
@ag-ui/a2ui-toolkit
create-ag-ui-app
@ag-ui/client
@ag-ui/core
@ag-ui/encoder
@ag-ui/proto
commit: |
AlemTuzlak
previously approved these changes
Jul 1, 2026
…lse green The "passes no transport options when no headers are configured" test asserted only `mockHTTPTransportOpts[0]` toBeUndefined, which also holds when the HTTP transport is never constructed — a false green. Added `expect(mockHTTPTransportCalls).toHaveLength(1)` (matching its sibling tests at line 563) so the test proves the transport WAS built and built with no options. Call sites: mockHTTPTransportCalls (test-only spy array) — reset in beforeEach, asserted-only; no production symbols changed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1862
Root cause
MCPAppsMiddlewareproxiestools/call/resources/readto MCP servers via transports built fromMCPClientConfig. Two gaps:MCPClientConfigHTTPhad noheadersfield, so HTTP/OAuth/header-protected MCP servers were unreachable.MCPClientConfigSSE.headers(which existed) was never wired — all three transport-construction sites callednew SSEClientTransport(url)/new StreamableHTTPClientTransport(url)with no options.Fix
headers?: Record<string, string>toMCPClientConfigHTTP.buildMCPTransport(config)helper that forwardsheadersto both transports viarequestInit, and use it at all three construction sites (de-duplicating the identical blocks).headersingetServerHashfor both transport types so header-differentiated servers hash distinctly.Tests added
__tests__/mcp-apps-middleware.test.ts(transport mocks extended to capture constructor options):{ requestInit: { headers } }{ requestInit: { headers } }(previously dead path)getServerHashdistinguishes HTTP servers differing only by headersThe two transport-wiring tests fail against the pre-fix code and pass with the fix.
Checklist
nx run @ag-ui/mcp-apps-middleware:build)