fix(config): expand env vars in MCP HTTP/SSE headers (#365) - #367
Merged
Million-mo merged 3 commits intoAug 11, 2026
Conversation
Expand ${VAR} placeholders in SSEMCPServerConfig and
StreamableHTTPMCPServerConfig header values via os.path.expandvars
before transport construction, in both to_transport() and the session
pool's _create_transport(). Without this, authenticated MCP servers
receiving 'Bearer ${TOKEN}' literals fail with 401.
Resolves wolf1069b#365.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
…1069b#365) Add reproductions verifying ${VAR} expansion in to_transport() and _create_transport() for both SSE and streamable-http transports. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
…olf1069b#365) Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
MCP HTTP/SSE header values now support
${VAR}environment variable expansion before the transport is created. Previously a header likeAuthorization: Bearer ${API_TOKEN}was sent to the MCP server as a literal string, causing401 Unauthorizedfor authenticated servers and forcing users to hard-code credentials in YAML.Why
Fixes #365. The expansion mirrors the existing
${VAR}support already present for skillmcp.jsoncompanion files (wolfharness.skills.skill._expand_env_vars_in_value).Changes
src/wolfharness_config/mcp_server.py: add_expand_headers()helper; use it inSSEMCPServerConfig.to_transport()andStreamableHTTPMCPServerConfig.to_transport()src/wolfharness/mcp_server/session_pool.py: apply the same expansion in_create_transport()(a separate transport-construction path that does not route throughto_transport())Verification
ruff check/ruff formatpass (also validated by pre-commit)tests/config/test_mcp_server_config.py+tests/mcp_server/test_session_pool.pycurlagainst a/mcpendpoint with Bearer token resolves 401 → successful MCPinitializeNotes
os.path.expandvarsleaves unresolved placeholders as-is (no error) — unmatched env var names silently pass through, so a typo'd variable will still send the literal and fail at auth. This matches the existing skillmcp.jsonbehavior.