{"record":{"id":"0137037dd5db63fb","repo":"HKUDS/Vibe-Trading","slug":"mcp-servers-using-auth-must-not-also-set-static-he","errorCode":null,"errorMessage":"MCP servers using auth must not also set static headers (the OAuth provider owns the Authorization header)","messagePattern":"MCP servers using auth must not also set static headers \\(the OAuth provider owns the Authorization header\\)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"agent/src/config/schema.py","lineNumber":404,"sourceCode":"        if transport == \"stdio\":\n            if not self.command.strip():\n                raise ValueError(\"stdio MCP servers require a command\")\n            if self.url.strip() or self.headers:\n                raise ValueError(\"stdio MCP servers do not accept url/headers\")\n            if self.auth is not None:\n                raise ValueError(\"stdio MCP servers do not accept auth (OAuth is HTTP-only)\")\n            return self\n\n        if not self.url.strip():\n            raise ValueError(f\"{transport} MCP servers require a url\")\n        if self.command.strip() or self.args or self.env:\n            raise ValueError(f\"{transport} MCP servers do not accept command/args/env\")\n\n        if self.auth is not None:\n            # The OAuth provider owns the runtime Authorization header; a\n            # hand-set static header alongside it is always a config error.\n            if self.headers:\n                raise ValueError(\n                    \"MCP servers using auth must not also set static headers \"\n                    \"(the OAuth provider owns the Authorization header)\"\n                )\n            # A refresh token must never traverse cleartext.\n            if not self.url.strip().lower().startswith(\"https://\"):\n                raise ValueError(\"OAuth MCP servers require an https url\")\n        return self\n\n\nclass MCPServerConfigOverride(ConfigBase):\n    \"\"\"Partial MCP server override used for runtime config layering.\"\"\"\n\n    type: Literal[\"stdio\", \"sse\", \"streamableHttp\"] | None = None\n    command: str | None = None\n    args: list[str] | None = None\n    env: dict[str, str] | None = None\n    url: str | None = None\n    headers: dict[str, str] | None = None","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/HKUDS/Vibe-Trading/blob/80ffdda44c5c4db0dd84d70e051cca591cea67df/agent/src/config/schema.py#L386-L422","documentation":"Raised by validate_transport_config when an HTTP server defines both an auth block and static headers. The OAuth provider injects the Authorization header at runtime, so a hand-set static header would conflict with or shadow it — the schema treats this as always a config error.","triggerScenarios":"An entry with auth set (e.g. OAuth client) plus a headers: {Authorization: ...} or any static headers mapping.","commonSituations":"Migrating from static API-key headers to OAuth and leaving old headers in place; copy-pasted examples that include both auth styles.","solutions":["Delete the headers block and let the OAuth provider manage Authorization.","If static headers were for a proxy or custom API key (not OAuth), remove auth and keep only headers."],"exampleFix":"# before\nmcp_servers:\n  broker:\n    type: streamableHttp\n    url: https://api.example.com/mcp\n    auth: {client_id: abc}\n    headers: {Authorization: \"Bearer x\"}\n\n# after\nmcp_servers:\n  broker:\n    type: streamableHttp\n    url: https://api.example.com/mcp\n    auth: {client_id: abc}","handlingStrategy":"validation","validationCode":"def auth_headers_exclusive(entry: dict) -> bool:\n    if entry.get('auth') is not None:\n        return not entry.get('headers')\n    return True","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Choose one auth mechanism per server: OAuth auth block OR static headers","Remove legacy headers when onboarding OAuth"],"tags":["mcp","config","oauth","headers","validation"],"backgroundTag":"config-validation-failed","analyzedSha":"80ffdda44c5c4db0dd84d70e051cca591cea67df","analyzedAt":"2026-08-28T12:46:38.989Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}