mirror of
https://github.com/open-webui/mcpo.git
synced 2026-07-19 23:14:20 -04:00
issue: HTTP-headers not forwarded to MCP/SSE-Server #83
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @MBueschelberger on GitHub (Jun 22, 2025).
Check Existing Issues
mcpo Version
v0.0.15
Open WebUI Version (if applicable)
No response
Operating System
Latest Docker Image
Browser (if applicable)
cURL-command
Confirmation
README.md.Expected Behavior
I have the setup of a MCPO-server (version 0.0.15) running on the latest Docker image from Github and a FastMCP (Version 2.6.1) server running in a separate container.
I would like to receive the headers in my FastMCP server, which were forwarded from the MCPO proxy. By doing so, I am passing a simple HTTP-request to the MCPO-server.
I am doing this, because I want to use the MCPO as an agent tool in OpenWebUI and I am using cURL commands in order to debug the header forwarding. The FastMCP will later use the token from the header in order to call a further external tool, since this Bearer-token comes from the same OAuth-session as the one faciliated for authentication in OpenWebUI.
The workflow then looks like this:
HTTP Request (with Auth-header) from cURL/OpenWebUI --sent-to--> MCPO server --is-forwarding-headers-to-> FastMCP-server --executes-with-JWT--> Third Party toolThe latest version (v0.0.15) of MCPO supports custom headers, but they only seem to enable static header information, which is not helpful in case when my FastAPI is calling a third-party tool, which is using a time-limited JWT for authorization.
Actual Behavior
I can not observe that the Auth-Header was not forwarded to the FastMCP-tool, despite the fact that the
Middleware-object in themcpo-package seems to allow header-forwarding of any client by default.If I call my FastMCP-tool directly, I have no problems with the header forwarding, which indicates that the problem is related to the MCPO proxy (see steps-to-reproduce for code reference).
Steps to Reproduce
My MCP-Server (version is:
My MCPO-command (
v0.0.15) is:My cURL command for debugging the header forwarding is:
The header forwarding works propery when calling the FastMCP directly:
Logs & Screenshots
FastMCP logs when calling via HTTP through MCPO:
FastMCP logs when calling directly:
Additional Information
Is the MCPO configured wrong or is it a bug in the FastAPI implementation of MCPO?
@aklowther commented on GitHub (Jul 8, 2025):
I'm also experiencing this issue
@Manyfaces860 commented on GitHub (Aug 1, 2025):
were you able to solve this issue?
@Manyfaces860 commented on GitHub (Aug 1, 2025):
@MBueschelberger in case if anyone is still stuck on the header problem, here is the correct example command for solving this issue
uv run mcpo --port 8000 --server-type sse --header "{\"Authorization\" :\"Bearer my-secret-access-token\"}" -- http://localhost:8001/sse@MBueschelberger commented on GitHub (Aug 4, 2025):
@Manyfaces860, this does not solve the issue since it is a static access token. The use case mentioned above is picturing the sceanario, that we have a JWT token, which is valid only for an OAuth2-session opened by the user in OpenWebUI, e.g. by Keycloak. This token expires when the session is closed, e.g. after the timeout and the user needs to re-login.
This is why a static header does not make sense here, since the auth-Header needs to be dynamic - due to the nature of the expiration of web tokens. It can be simply solved by allowing the headers from any incoming request towards the MCPO-server.
This usually should be covered by the
allow_headers-wildcard in theFastAPI-Middleware registration in themcpo.main.py, but it somehow still blocks the incoming headers. This is why it needs to be debugged and investigated in detail.@Manyfaces860 commented on GitHub (Aug 4, 2025):
@MBueschelberger
I forgot to consider the jwt token expiration issue, thanks for reminding me!
I actually debugged the flow of headers and found that it only sends those headers which are given to it when the mcpo Proxy is initialized, it does not have a mechanism for dynamic header forwarding yet, it uses
session.calltoolmethod for invoking tools on the mcp server and it does not have any argument for headers , only tool_name and args, so one way is that the header can be sent in the args argument but then your server will have to make sure it checks the token in the arguments.I will also try to find another way.
@alevsh commented on GitHub (Aug 15, 2025):
Have the same issue, any updates?
@Baronco commented on GitHub (Sep 7, 2025):
Have the same issue, any updates? x2
@scriptbotprime commented on GitHub (Sep 17, 2025):
I'd be interested in passing the token from OpenWebUI to the MCP server as well.
@rkconsulting commented on GitHub (Sep 18, 2025):
@MBueschelberger @aklowther @Baronco @alevsh @scriptbotprime
implemented tool-call level client header forwarding in this PR: https://github.com/open-webui/mcpo/pull/251
@varunkhanna96 commented on GitHub (Oct 9, 2025):
tried this branch and dev branch of mcpo repo as well. facing issue
2025-10-09 20:49:21,127 - INFO - Unexpected error calling XXXXX: Traceback (most recent call last): File "XXXX/venv/lib/python3.11/site-packages/mcpo/utils/main.py", line 303, in tool result = await session.call_tool(endpoint_name, arguments=args, _meta=meta if meta else None) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ TypeError: ClientSession.call_tool() got an unexpected keyword argument '_meta'do we need to upgrade downgrade mcp package as well? as clearly FastMCP class does not support any _meta input variable. I'm on the latest version of mcp package.
async def call_tool( self, name: str, arguments: dict[str, Any] | None = None, read_timeout_seconds: timedelta | None = None, progress_callback: ProgressFnT | None = None, )@MBueschelberger commented on GitHub (Oct 20, 2025):
This seems to be resolved with version 0.0.19 since the
_metakwarg got removed there.@MBueschelberger commented on GitHub (Oct 20, 2025):
However, even though I followed this guide for the configuration, I still encounter the same issue when using version 0.0.19.
It is probably due to the case, that the
meta-variable is assigned but never used in version 0.0.19. This is a reverted change from version 0.0.18 (see release notes here)@GlisseManTV commented on GitHub (Dec 18, 2025):
Should be solved by #273
@Baronco commented on GitHub (Dec 20, 2025):
any news about this bug? I would like to be able to pass the user session authorization bearer token to my MCP
@rlaneth commented on GitHub (Jan 19, 2026):
I'm having this issue, too.
While recent versions of Open WebUI have implemented native MCP support, I've found it almost impossible to make it work properly with industry-standard libraries such as Laravel MCP. This matches the warning presented on the web interface itself:
I love Open WebUI, but there's a point to be made about how bad it is currently for integration with external tools. The developers may bring in grandiose claims about how MCP is supposedly "missing standard features" and "is experimental and changes often," but it's very clear that the real reason is NIH.
MCP is an industry-standard that should've been supported to the get-go. It's a consensus in the industry, including Anthropic, Google, even OpenAI. The only ones who seem to find it "not good enough" are the OWU developers who went for the mcpo hack.
As things stand now, we'll have to fork mcpo for internal use so we can work around the problems.
@GlisseManTV commented on GitHub (Jan 19, 2026):
Hi !
that's why for my AIO tool (I have both version streamable Http & builtin mcpo) I forked their integration to implement http headers fw.
Finally, maybe they are waiting from us to avoid using their tool.