skills.rest
githubnext
githubnextOFFICIAL
Explore all skills by this author →
Website𝕏@githubnextGitHub

http_mcp_headers

Extract secrets from HTTP MCP headers and replace them with environment variable references.

4.9k|489|Updated Aug 12, 2025
Search Tags:#developer tools#security#github actions#mcp#secrets#http#copilot
One-click install
npx skills add https://github.com/githubnext/gh-aw --skill http-mcp-headers
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: http_mcp_headers
Source: https://github.com/githubnext/gh-aw/tree/main/skills/http-mcp-headers
Command: npx skills add https://github.com/githubnext/gh-aw --skill http-mcp-headers

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill details the secure implementation of HTTP MCP header secret support, allowing AI agents to safely pass GitHub Actions secrets to external MCP servers without exposing sensitive information in configuration files. It ensures robust security for AI integrations.

Core Features & Use Cases

  • Secure Secret Extraction: Automatically identify and extract secret expressions (e.g., ${{ secrets.VAR_NAME }}) from HTTP headers.
  • Environment Variable Passthrough: Declare secrets as environment variables in the execution step and configure MCP config to pass them through securely.
  • Consistent Security Pattern: Matches existing GitHub remote MCP server implementation for reliable secret handling.
  • Test Coverage: Comprehensive unit and integration tests ensure the secure handling of secrets across various scenarios.
  • Use Case: A workflow author needs to configure an AI agent to interact with a Datadog MCP server using API keys stored as GitHub secrets. This skill explains how the system securely handles ${{ secrets.DD_API_KEY }} in the MCP server headers.

Quick Start

Consult the http-mcp-headers skill to understand how GitHub Actions secrets are securely passed to HTTP MCP servers via environment variables.

Frequently Asked Questions about http_mcp_headers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely pass GitHub Actions secrets to HTTP MCP servers?▼

Extract secret expressions like `${{ secrets.VAR }}` from HTTP headers, declare them as environment variables in your execution step, and configure the MCP config to reference those env vars. This prevents secrets from appearing in configuration files while enabling secure passthrough to external MCP servers.

What's the best way to handle API keys in MCP server headers?▼

Use environment variable passthrough for API keys stored as GitHub secrets. The system parses secret expressions in headers, replaces them with env var references in mcp-config.json, and injects the actual values at runtime, keeping sensitive data out of version control.

Can I use GitHub Actions secrets with HTTP MCP servers in Copilot workflows?▼

Yes. This approach extracts secrets from HTTP MCP headers, renders them as environment variables, and collects them for secure execution environments. It matches the existing GitHub remote MCP server security pattern for consistent, robust handling across AI agent integrations.

How does environment variable passthrough work for MCP configuration?▼

Secrets declared in execution steps are injected as environment variables and referenced in mcp-config.json headers via env var syntax instead of hardcoded values. The MCP server receives the actual secret at runtime without it being stored in configuration files.

What security patterns does HTTP MCP header secret handling follow?▼

It matches GitHub's remote MCP server implementation, using tested extraction, replacement, and passthrough logic. Comprehensive unit and integration tests verify secure handling across scenarios, ensuring secrets are never exposed in configs or logs.

Related Skills

Explore More Software Engineering Skills→
kaushal-waygoodkaushal-waygood

http_mcp_headers

Extract GitHub Actions secrets from HTTP MCP headers and replace them with environment variable references.

Community
Intermediate
az9713az9713

http_mcp_headers

Extract HTTP MCP header secrets into environment variable passthroughs.

Community
Advanced
githubgithub
4.9k

http_mcp_headers

Convert HTTP MCP header secrets into environment variable passthrough.

Official
Advanced
PlazaCCPlazaCC
2

dotenvx

Encrypt .env files and inject decrypted variables into process.env at runtime.

Official
Intermediate