{"record":{"id":"a62ac628725baaac","repo":"openai/codex","slug":"mcp-http-headers-helper-wrote-non-utf-8-data","errorCode":null,"errorMessage":"MCP HTTP headers helper wrote non-UTF-8 data","messagePattern":"MCP HTTP headers helper wrote non-UTF-8 data","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/rmcp-client/src/http_headers.rs","lineNumber":350,"sourceCode":"            return Err(anyhow!(\"MCP HTTP headers helper output exceeds 64 KiB\"));\n        }\n        let status = process.child.wait().await?;\n        if !status.success() {\n            return Err(anyhow!(\n                \"MCP HTTP headers helper exited with status {status}\"\n            ));\n        }\n        Ok(output)\n    })\n    .await\n    .map_err(|_| anyhow!(\"MCP HTTP headers helper timed out after 10 seconds\"))??;\n\n    parse_helper_output(output)\n}\n\nfn parse_helper_output(stdout: Vec<u8>) -> Result<HeaderMap> {\n    let stdout = String::from_utf8(stdout)\n        .map_err(|_| anyhow!(\"MCP HTTP headers helper wrote non-UTF-8 data\"))?;\n    let mut deserializer = serde_json::Deserializer::from_str(stdout.trim());\n    let headers = RawHeaderEntries::deserialize(&mut deserializer)\n        .and_then(|headers| {\n            deserializer.end()?;\n            Ok(headers)\n        })\n        .map_err(|_| anyhow!(\"MCP HTTP headers helper must output a JSON object of strings\"))?;\n    if headers.has_exact_duplicate {\n        return Err(anyhow!(\n            \"MCP HTTP headers helper returned duplicate header names\"\n        ));\n    }\n    let mut parsed = HeaderMap::with_capacity(headers.entries.len());\n    for (name, value) in headers.entries {\n        let name = HeaderName::from_bytes(name.as_bytes())\n            .map_err(|_| anyhow!(\"MCP HTTP headers helper returned an invalid header name\"))?;\n        // Helper values replace same-name configured headers; bearer/OAuth owns Authorization.\n        // Google IAP uses Proxy-Authorization alongside application Authorization. For HTTPS MCP","sourceCodeStart":332,"sourceCodeEnd":368,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/rmcp-client/src/http_headers.rs#L332-L368","documentation":"Helper stdout must decode as UTF-8 (String::from_utf8) before any JSON parsing happens; this error fires when the bytes are not valid UTF-8. Binary output, UTF-16 from Windows tools, Latin-1 text, or encrypted blobs all land here. The message deliberately does not include the offending bytes, so secrets never leak into logs.","triggerScenarios":"A helper writing raw binary to stdout (cat of a binary file), a Windows tool emitting UTF-16, or any program printing bytes outside valid UTF-8 sequences.","commonSituations":"Debug scripts dumping binary artifacts; PowerShell tools writing UTF-16 by default; encrypted or compressed credential blobs printed verbatim; locale-dependent output.","solutions":["Ensure the helper prints only UTF-8 JSON on stdout","Force UTF-8 in the helper (e.g. [Console]::OutputEncoding = UTF8 in PowerShell, LC_ALL=C.UTF-8)","Never cat binary files; extract and print only the needed string values","Verify with: sh -c \"$CMD\" | iconv -f UTF-8 -t UTF-8 >/dev/null && echo ok"],"exampleFix":"# before: helper cats a UTF-16/binary credential file\n# after\nprintf '{\"X-Api-Key\":\"%s\"}' \"$(extract_ascii_key ~/.creds/bin)\"","handlingStrategy":"validation","validationCode":"# Fail fast if stdout is not valid UTF-8\ncd \"$MCP_CWD\" && env -i PATH=/usr/bin:/bin sh -c \"$HTTP_HEADERS_HELPER\" \\\n  | iconv -f UTF-8 -t UTF-8 >/dev/null && echo utf8-ok || echo non-utf8-output","typeGuard":"fn is_helper_non_utf8(error: &anyhow::Error) -> bool {\n    error.to_string().contains(\"non-UTF-8\")\n}","tryCatchPattern":null,"preventionTips":["Print only ASCII/UTF-8 JSON on stdout","Set LC_ALL/C.UTF-8 (or PowerShell UTF-8 output encoding) inside helpers","Never dump binary or UTF-16 files to stdout"],"tags":["rust","mcp","headers-helper","utf-8","encoding"],"backgroundTag":"invalid-utf8-output","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}