http_mcp_headers

Name: http_mcp_headers
Availability: InStock
Author: az9713

Extract HTTP MCP header secrets into environment variable passthroughs.

Updated Feb 18, 2026

Search Tags:#security #mcp #secrets #http #headers #copilot #passthrough

Ready to run

npx skills add https://github.com/az9713/gh-aw --skill http-mcp-headers-az9713

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: http_mcp_headers
Source: https://github.com/az9713/gh-aw/tree/main/skills/http-mcp-headers
Command: npx skills add https://github.com/az9713/gh-aw --skill http-mcp-headers-az9713

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

HTTP MCP header secret handling is error-prone when secrets are embedded directly in headers. This Skill provides a secure pattern to extract secrets from headers, declare them as environment variables, and passthrough those values into the MCP configuration without leaking sensitive data.

Core Features & Use Cases

Secret extraction: identifies and collects secret expressions from header values.
Env passthrough: renders MCP config with environment variable references instead of raw secrets.
Security-focused rendering: ensures secrets are only exposed as passthrough variables at execution time.

Quick Start

Configure your workflow to route secrets through HTTP MCP headers and let the tool render the correct env passthrough in the MCP config.

Frequently Asked Questions about http_mcp_headers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I securely pass secrets through HTTP MCP headers in Copilot workflows?▼

Secret passthrough in MCP configurations replaces raw secret values in HTTP headers with environment variable references. This technique prevents secret leakage by declaring secrets as environment variables and injecting them at execution time via an mcp-config.json file.

Why does embedding API keys directly in HTTP MCP headers cause security issues?▼

Embedding API keys like DD_API_KEY directly in HTTP MCP headers causes security issues because raw secrets can be exposed in logs or configuration files. Extracting secrets into environment variable passthroughs prevents this leakage while preserving GitHub Secrets handling at runtime.

How do I configure an mcp-config.json file for environment variable passthrough?▼

Configuring an mcp-config.json for environment variable passthrough requires parsing header secrets, generating environment variable references instead of raw values, and rendering execution-time environment variable wiring to securely inject secrets into MCP server interactions.

Can I use GitHub Secrets with HTTP MCP server configurations?▼

You can use GitHub Secrets with HTTP MCP server configurations by extracting secret expressions from headers and passing them through as environment variables. The Skill preserves GitHub Secrets handling while rendering the correct passthrough wiring for Copilot workflows.

What is the best way to inject DD_API_KEY into MCP headers without leaking the secret?▼

The best way to inject DD_API_KEY into MCP headers without leaking the secret is extracting the key from header values and declaring it as an environment variable. The MCP config then references the environment variable, exposing the secret only at execution time.

Does this secret passthrough approach work with existing Copilot workflows?▼

This secret passthrough approach works with Copilot workflows by rendering execution-time environment variable wiring into the workflow configuration. It parses HTTP MCP header secrets and generates an mcp-config.json that securely injects secrets during runtime execution.