Forwards all MCP non-transport headers, to downstream methods

Author: bnasslahsen

springdoc-openapi-starter-common-mcp/src/main/java/org/springdoc/ai/dashboard/McpDashboardController.java

@@ -30,9 +30,9 @@
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
 import io.swagger.v3.oas.annotations.Operation;
+import org.springdoc.ai.mcp.McpRequestContextHolder;
 
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.DeleteMapping;
@@ -89,13 +89,6 @@ public List<McpToolInfo> listTools() {
 		return List.copyOf(toolsByName.values());
 	}
 
-	/**
-	 * Headers to skip when forwarding to tool execution.
-	 */
-	private static final Set<String> SKIP_HEADERS = Set.of("content-type", "content-length", "host", "connection",
-			"accept", "accept-encoding", "accept-language", "user-agent", "origin", "referer", "cookie",
-			"sec-fetch-dest", "sec-fetch-mode", "sec-fetch-site", "sec-ch-ua", "sec-ch-ua-mobile",
-			"sec-ch-ua-platform");
 
 	/**
 	 * Executes an MCP tool by name, forwarding any authentication headers (Authorization,
@@ -110,7 +103,7 @@ public ResponseEntity<McpToolExecutionResponse> executeTool(@RequestBody McpTool
 			@RequestHeader Map<String, String> allHeaders) {
 		Map<String, String> extraHeaders = new HashMap<>();
 		for (Map.Entry<String, String> entry : allHeaders.entrySet()) {
-			if (!SKIP_HEADERS.contains(entry.getKey().toLowerCase()) && entry.getValue() != null
+			if (!McpRequestContextHolder.SKIP_HEADERS.contains(entry.getKey().toLowerCase()) && entry.getValue() != null
 					&& !entry.getValue().isEmpty()) {
 				extraHeaders.put(entry.getKey(), entry.getValue());
 			}

springdoc-openapi-starter-common-mcp/src/main/java/org/springdoc/ai/mcp/OpenApiToolCallback.java

@@ -402,6 +402,12 @@ private HttpResponse<String> executeHttp(String toolInput, Map<String, String> e
 			if (extraHeaders != null) {
 				extraHeaders.forEach(requestBuilder::header);
 			}
+			else {
+				Map<String, String> contextHeaders = McpRequestContextHolder.getHeaders();
+				if (contextHeaders != null) {
+					contextHeaders.forEach(requestBuilder::header);
+				}
+			}
 
 			String bodyString = buildBodyString(input);
 			HttpRequest.BodyPublisher bodyPublisher = bodyString != null

springdoc-openapi-starter-webflux-mcp/src/main/java/org/springdoc/webflux/ai/McpWebFluxAiAutoConfiguration.java

@@ -66,6 +66,18 @@
 @ConditionalOnWebApplication(type = Type.REACTIVE)
 public class McpWebFluxAiAutoConfiguration {
 
+	/**
+	 * Creates the {@link McpAuditMdcWebFilter} that populates MDC and
+	 * {@link org.springdoc.ai.mcp.McpRequestContextHolder} for MCP requests.
+	 * @param aiProperties the AI properties (used to scope the filter to the MCP path)
+	 * @return the WebFilter bean
+	 */
+	@Bean
+	@ConditionalOnMissingBean(McpAuditMdcWebFilter.class)
+	McpAuditMdcWebFilter mcpAuditMdcWebFilter(SpringDocAiProperties aiProperties) {
+		return new McpAuditMdcWebFilter(aiProperties.getMcpEndpoint());
+	}
+
 	/**
 	 * Creates the {@link McpToolDescriptionCustomizer} bean that scans WebFlux handler
 	 * methods for {@link org.springdoc.ai.annotations.McpToolDescription} annotations.

springdoc-openapi-starter-webmvc-mcp/src/main/java/org/springdoc/webmvc/ai/McpAuditMdcFilter.java

@@ -27,12 +27,16 @@
 package org.springdoc.webmvc.ai;
 
 import java.io.IOException;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.Map;
 
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.slf4j.MDC;
+import org.springdoc.ai.mcp.McpRequestContextHolder;
 
 import org.springframework.web.filter.OncePerRequestFilter;
 
@@ -90,15 +94,38 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
 		if (sessionId != null && !sessionId.isBlank()) {
 			MDC.put(MDC_SESSION_ID, sessionId);
 		}
+		McpRequestContextHolder.setHeaders(extractForwardableHeaders(request));
 		try {
 			filterChain.doFilter(request, response);
 		}
 		finally {
 			MDC.remove(MDC_CLIENT_IP);
 			MDC.remove(MDC_SESSION_ID);
+			McpRequestContextHolder.clear();
 		}
 	}
 
+	/**
+	 * Extracts headers from the servlet request that should be forwarded to downstream
+	 * REST API calls, filtering out standard HTTP transport/browser headers.
+	 * @param request the HTTP servlet request
+	 * @return the forwardable headers map
+	 */
+	private Map<String, String> extractForwardableHeaders(HttpServletRequest request) {
+		Map<String, String> headers = new HashMap<>();
+		Enumeration<String> headerNames = request.getHeaderNames();
+		while (headerNames.hasMoreElements()) {
+			String name = headerNames.nextElement();
+			if (!McpRequestContextHolder.SKIP_HEADERS.contains(name.toLowerCase())) {
+				String value = request.getHeader(name);
+				if (value != null && !value.isEmpty()) {
+					headers.put(name, value);
+				}
+			}
+		}
+		return headers;
+	}
+
 	/**
 	 * Resolves the originating client IP from the request. Prefers the first value in
 	 * {@code X-Forwarded-For} when set, otherwise falls back to the direct remote