Extract HTTP MCP header secrets into environment variable passthroughs.
npx skills add https://github.com/az9713/gh-aw --skill http-mcp-headers-az9713
Please help me install this Agent Skill. Skill: http_mcp_headers Source: https://github.com/az9713/gh-aw/tree/main/skills/http-mcp-headers Command: npx skills add https://github.com/az9713/gh-aw --skill http-mcp-headers-az9713
HTTP MCP header secret handling is error-prone when secrets are embedded directly in headers. This Skill provides a secure pattern to extract secrets from headers, declare them as environment variables, and passthrough those values into the MCP configuration without leaking sensitive data.
Configure your workflow to route secrets through HTTP MCP headers and let the tool render the correct env passthrough in the MCP config.
High-intent search queries and answers about installing and using this skill.
Secret passthrough in MCP configurations replaces raw secret values in HTTP headers with environment variable references. This technique prevents secret leakage by declaring secrets as environment variables and injecting them at execution time via an mcp-config.json file.
Embedding API keys like DD_API_KEY directly in HTTP MCP headers causes security issues because raw secrets can be exposed in logs or configuration files. Extracting secrets into environment variable passthroughs prevents this leakage while preserving GitHub Secrets handling at runtime.
Configuring an mcp-config.json for environment variable passthrough requires parsing header secrets, generating environment variable references instead of raw values, and rendering execution-time environment variable wiring to securely inject secrets into MCP server interactions.
You can use GitHub Secrets with HTTP MCP server configurations by extracting secret expressions from headers and passing them through as environment variables. The Skill preserves GitHub Secrets handling while rendering the correct passthrough wiring for Copilot workflows.
The best way to inject DD_API_KEY into MCP headers without leaking the secret is extracting the key from header values and declaring it as an environment variable. The MCP config then references the environment variable, exposing the secret only at execution time.
This secret passthrough approach works with Copilot workflows by rendering execution-time environment variable wiring into the workflow configuration. It parses HTTP MCP header secrets and generates an mcp-config.json that securely injects secrets during runtime execution.
kaushal-waygoodExtract GitHub Actions secrets from HTTP MCP headers and replace them with environment variable references.
githubConvert HTTP MCP header secrets into environment variable passthrough.
githubnextExtract secrets from HTTP MCP headers and replace them with environment variable references.
zkp2pMonitors real-time Peer protocol events for intents, deposits, and rate changes.
