Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

No way to forward a static Authorization header to a local container-backed MCP server (SSE readiness probe always 401)

Aperta
  • Qualcosa non va?
#6,798 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
22/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, go
Ambito
authentication, backend

Direzione di ricerca

Start from waitForInitializeSuccess, the readiness probe that sends an unauthenticated GET and accepts only HTTP 200, and from the local proxy path that forwards requests to container-backed workloads. Compare with the existing --remote-forward-headers and --remote-forward-headers-secret handling for remote servers, and the vMCP passthroughHeaders discussion in #6523 and #6394. Done means the design decides where static headers are configured and applied to both the probe and forwarded requests, which needs maintainer input first.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs-triage

Summary

ToolHive cannot proxy a local (non-remote) container-backed MCP server that requires a static Bearer token on its protocol endpoints. The SSE/streamable-HTTP readiness probe (waitForInitializeSuccess) sends an unauthenticated GET to the proxied backend and only accepts HTTP 200 — so a backend whose MCP endpoints are behind an auth gate (e.g. Crawl4AI 0.9.x AuthGateMiddleware) never becomes "ready" and the workload stays stuck in initializing until the 5m timeout (initialize not successful).

Repro

Crawl4AI 0.9.4 (see unclecode/crawl4ai, fail-closed AuthGateMiddleware): every MCP endpoint (/sse, /mcp/sse, /messages) requires Authorization: Bearer $CRAWL4AI_API_TOKEN. ToolHive probe hits http://localhost:<proxy>/sse without a token → always HTTP 401 → workload never ready.

  • Probe log: Still waiting for MCP server to be ready ... last_observed: "HTTP 401" then initialize not successful after 5m0s (154 attempts, last observed: HTTP 401).

What's missing

A way to tell ToolHive the static credential it should attach to every request it forwards to the (local) backend. Related work exists but only for remote servers and vMCP:

  • --remote-forward-headers / --remote-forward-headers-secret → only for remote servers, not local image:-backed workloads.
  • #6523 / #6394 → vMCP passthroughHeaders — rejected for Authorization/Cookie without an opt-in, and not applicable to the plain local proxy path.

Expected behavior

Optionally attach static headers (e.g. Authorization: Bearer <token> from ToolHive secrets) to the readiness probe and to forwarded MCP requests for local container-backed workloads — so token-protected backends like Crawl4AI 0.9.x can be proxied directly without a custom stdio bridge.

Workaround used

A custom pinned image that runs a stdio bridge in the foreground (the bridge carries the token itself) and is started with --transport stdio. This works but forces every token-protected backend to ship a custom bridge.

Environment

  • ToolHive v0.50.0 (Linux, Docker)
  • Crawl4AI 0.9.4 (token-protected SSE backend)
Lingua principale
Go
Stelle
2.3k
Fork
318
Merge medio
2g 8h
PR unite (30g)
79

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di stacklok/toolhive

Tutte le issue di stacklok/toolhive

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.