feat(auth): Support additional HTTP headers in MCP tools

PiperOrigin-RevId: 893287579

Author: google-genai-bot

src/google/adk/tools/mcp_tool/mcp_tool.py

@@ -479,6 +479,9 @@ async def _get_headers(
                   f" {credential.http.credentials.token}"
               )
           }
+        if credential.http.additional_headers:
+          headers = headers or {}
+          headers.update(credential.http.additional_headers)
       elif credential.api_key:
         if (
             not self._credentials_manager

src/google/adk/tools/mcp_tool/mcp_toolset.py

@@ -240,6 +240,10 @@ def _get_auth_headers(self) -> Optional[Dict[str, str]]:
                 f"{credential.http.scheme} {credential.http.credentials.token}"
             )
         }
+
+      if credential.http.additional_headers:
+        headers = headers or {}
+        headers.update(credential.http.additional_headers)
     elif credential.api_key:
       # For API key, use the auth scheme to determine header name
       if self._auth_config.auth_scheme:

tests/unittests/tools/mcp_tool/test_mcp_tool.py

@@ -14,6 +14,7 @@
 
 import inspect
 from unittest.mock import AsyncMock
+from unittest.mock import create_autospec
 from unittest.mock import Mock
 from unittest.mock import patch
 
@@ -415,6 +416,44 @@ async def test_get_headers_http_basic(self):
     expected_encoded = base64.b64encode(b"user:pass").decode()
     assert headers == {"Authorization": f"Basic {expected_encoded}"}
 
+  @pytest.mark.asyncio
+  @pytest.mark.parametrize(
+      "token, expected_headers",
+      [
+          (
+              "some-token",
+              {
+                  "Authorization": "some-scheme some-token",
+                  "X-Custom-Header": "custom-value",
+              },
+          ),
+          (
+              None,
+              {"X-Custom-Header": "custom-value"},
+          ),
+      ],
+  )
+  async def test_get_headers_http_adds_additional_headers(
+      self, token, expected_headers
+  ):
+    tool = MCPTool(
+        mcp_tool=self.mock_mcp_tool,
+        mcp_session_manager=self.mock_session_manager,
+    )
+    http_auth = HttpAuth(
+        scheme="some-scheme",
+        credentials=HttpCredentials(token=token),
+        additional_headers={"X-Custom-Header": "custom-value"},
+    )
+    credential = AuthCredential(
+        auth_type=AuthCredentialTypes.HTTP, http=http_auth
+    )
+
+    tool_context = create_autospec(ToolContext, instance=True)
+    headers = await tool._get_headers(tool_context, credential)
+
+    assert headers == expected_headers
+
   @pytest.mark.asyncio
   async def test_get_headers_api_key_with_valid_header_scheme(self):
     """Test header generation for API Key credentials with header-based auth scheme."""

tests/unittests/tools/mcp_tool/test_mcp_toolset.py

@@ -23,8 +23,13 @@
 from unittest.mock import Mock
 from unittest.mock import patch
 
+from fastapi.openapi.models import OAuth2
 from google.adk.agents.readonly_context import ReadonlyContext
 from google.adk.auth.auth_credential import AuthCredential
+from google.adk.auth.auth_credential import AuthCredentialTypes
+from google.adk.auth.auth_credential import HttpAuth
+from google.adk.auth.auth_credential import HttpCredentials
+from google.adk.auth.auth_tool import AuthConfig
 from google.adk.tools.load_mcp_resource_tool import LoadMcpResourceTool
 from google.adk.tools.mcp_tool.mcp_session_manager import MCPSessionManager
 from google.adk.tools.mcp_tool.mcp_session_manager import SseConnectionParams
@@ -646,3 +651,26 @@ async def mock_sampling_handler(messages, params=None, context=None):
     assert called["value"] is True
     assert result["role"] == "assistant"
     assert result["content"]["text"] == "sampling response"
+
+  @pytest.mark.asyncio
+  async def test_get_auth_headers_includes_additional_headers(self):
+    credential = AuthCredential(
+        auth_type=AuthCredentialTypes.HTTP,
+        http=HttpAuth(
+            scheme="bearer",
+            credentials=HttpCredentials(token="token"),
+            additional_headers={"X-API-Key": "secret"},
+        ),
+    )
+    auth_config = AuthConfig(
+        auth_scheme=OAuth2(flows={}),
+        raw_auth_credential=credential,
+    )
+    auth_config.exchanged_auth_credential = credential
+    toolset = McpToolset(connection_params=self.mock_stdio_params)
+    toolset._auth_config = auth_config
+
+    headers = toolset._get_auth_headers()
+
+    assert headers["Authorization"] == "Bearer token"
+    assert headers["X-API-Key"] == "secret"