http_mcp_headers

Q: How do I install http_mcp_headers?

Run npx skills add https://github.com/github/gh-aw --skill http_mcp_headers in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/http_mcp_headers/ (personal) or .claude/skills/http_mcp_headers/ (project).

by githubAI & Agents

Implement secret-safe HTTP headers for MCP transport in gh-aw.

Installs: 56
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/github/gh-aw --skill http_mcp_headers

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads http_mcp_headers automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

HTTP MCP Header Secret Support - Implementation Summary

Use this reference for HTTP MCP header secret support in the copilot engine.

Problem Statement

When HTTP MCP headers include GitHub Actions secrets, mcp-config.json must:

Extract secrets from headers (e.g., ${{ secrets.DD_API_KEY }})
Declare those env variables in the execution step
Configure the MCP config's "env" section to passthrough those variables
Use the passed variables in the headers section

Example Workflow

on:
  workflow_dispatch:
permissions:
  contents: read
engine: copilot
mcp-servers:
  datadog:
    type: http
    url: "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp"
    headers:
      DD_API_KEY: "${{ secrets.DD_API_KEY }}"
      DD_APPLICATION_KEY: "${{ secrets.DD_APPLICATION_KEY }}"
      DD_SITE: "${{ secrets.DD_SITE || 'datadoghq.com' }}"
    allowed:
      - search_datadog_dashboards
      - search_datadog_slos
      - search_datadog_metrics
      - get_datadog_metric

# Datadog Dashboard Search

Search for Datadog dashboards and provide a summary.

Generated Output

1. MCP Config (mcp-config.json)

{
  "mcpServers": {
    "datadog": {
      "type": "http",
      "url": "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp",
      "headers": {
        "DD_API_KEY": "${DD_API_KEY}",
        "DD_APPLICATION_KEY": "${DD_APPLICATION_KEY}",
        "DD_SITE": "${DD_SITE}"
      },
      "tools": [
        "search_datadog_dashboards",
        "search_datadog_slos",
        "search_datadog_metrics",
        "get_datadog_metric"
      ],
      "env": {
        "DD_API_KEY": "\\${DD_API_KEY}",
        "DD_APPLICATION_KEY": "\\${DD_APPLICATION_KEY}",
        "DD_SITE": "\\${DD_SITE}"
      }
    }
  }
}

2. Execution Step Environment Variables

env:
  DD_API_KEY: ${{ secrets.DD_API_KEY }}
  DD_APPLICATION_KEY: ${{ secrets.DD_APPLICATION_KEY }}
  DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }}
  COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
  # ... other env vars

GH_AW_MCP_CONFIG is intentionally NOT in the YAML env: block — it is exported from the run script (export GH_AW_MCP_CONFIG="$HOME/.copilot/mcp-config.json") so $HOME is resolved at runtime. GitHub Actions does not shell-expand env: values, so the path must be set via export to work on self-hosted/containerized runners where HOME is not /home/runner.

Implementation Details

Key Functions

extractSecretsFromValue(value string) - Extracts secret expressions from a string
- Parses ${{ secrets.VAR_NAME }} patterns
- Handles default values: ${{ secrets.VAR || 'default' }}
- Returns map of variable names to full expressions
extractSecretsFromHeaders(headers map[string]string) - Extracts all secrets from HTTP headers
- Iterates through all header values
- Collects all unique secret expressions
- Returns consolidated map of secrets
replaceSecretsWithEnvVars(value string, secrets map[string]string) - Replaces secret expressions with env var references
- Transforms ${{ secrets.DD_API_KEY }} to ${DD_API_KEY}
- Used in MCP config headers rendering
collectHTTPMCPHeaderSecrets(tools map[string]any) - Collects secrets from all HTTP MCP tools
- Scans all tools for HTTP MCP configurations
- Extracts secrets from each tool's headers
- Returns consolidated map for execution step env

Rendering Logic

In renderSharedMCPConfig (mcp-config.go):

Extract secrets when rendering HTTP MCP configs for copilot engine
Add env section to property order when secrets are found
Render headers with env var references instead of secret expressions
Render env with passthrough syntax (\${VAR_NAME})

In GetExecutionSteps (copilot_engine.go):

Collect all HTTP MCP header secrets from workflow tools
Add to execution step env map with secret expressions

Security Benefits

Secrets never appear in MCP config - Only env var references
Proper GitHub Actions secret handling - Uses ${{ secrets.* }} syntax
Environment isolation - Each MCP server receives only its required secrets
Consistent pattern - Matches existing GitHub remote MCP server implementation

Test Coverage

Unit Tests (mcp_http_headers_test.go)

extractSecretsFromValue
extractSecretsFromHeaders
replaceSecretsWithEnvVars
collectHTTPMCPHeaderSecrets
renderSharedMCPConfig with HTTP headers

Integration Tests (copilot_mcp_http_integration_test.go)

Single HTTP MCP tool with secrets
Multiple HTTP MCP tools
HTTP MCP without secrets
Property ordering
Env variable sorting

All tests pass ✓

FAQ

What does the http_mcp_headers skill do?

Implement secret-safe HTTP headers for MCP transport in gh-aw.

How do I install http_mcp_headers?

Run npx skills add https://github.com/github/gh-aw --skill http_mcp_headers in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/http_mcp_headers/ (personal) or .claude/skills/http_mcp_headers/ (project).

Which AI agents can use http_mcp_headers?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is http_mcp_headers safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains http_mcp_headers?

It is published by github in github/gh-aw. It has 56 recorded installs.

Popular ai & agents skills

View category →

google-agents-cli-publish

google/agents-cli

This skill should be used when the user wants to "publish an agent", "publish my ADK agent", "register an agent with Gemini", "publish to Gemini" (formerly Gemini Enterprise), or needs guidance on the agents-cli publish gemini command. Also use when the user wants to "manage agents in Agent Registry", "list/update/delete registered agents", or "register an MCP server". Covers ADK vs A2A registration modes, programmatic and interactive usage, flag reference, auto-detection from deployment metadata, Agent Registry fleet management, and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment (use google-agents-cli-deploy).

AI & Agents513.9K installs

google-agents-cli-eval

google/agents-cli

This skill should be used when the user wants to "run an evaluation", "evaluate my agent", "evaluate my ADK agent", "write an eval dataset", "analyze eval failures", "compare eval results", "optimize agent", or needs guidance on the Gemini platform eval methodology and the Quality Flywheel. Covers eval metrics, dataset schema, LLM-as-judge scoring, and common failure causes. Applies to any agents-cli project, whatever framework the agent is written in. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), deployment (use google-agents-cli-deploy), or project scaffolding (use google-agents-cli-scaffold).

AI & Agents513.5K installs

skill-creator

anthropics/skills

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

OfficialAI & Agents416.4K installs

codex-pet

prime-skills/runcomfy-agent-skills

Codex Pet generator on RunComfy. Build a Codex-compatible Codex Pet spritesheet.webp + pet.json from a single reference image, drop it into ${CODEXHOME:-$HOME/.codex}/pets/ / and Codex picks it up as a custom Codex Pet next to the 8 built-ins. This skill produces the exact Codex Pet atlas Codex expects (1536x1872 PNG/WebP, 8 cols x 9 rows, 192x208 cells, 9 animation states — idle, running-right, running-left, waving, jumping, failed, waiting, running, review). Calls OpenAI GPT Image 2 edit ONCE via the local RunComfy CLI as runcomfy run openai/gpt-image-2/edit to produce a canonical Codex Pet pose, then assembles all 9 animation rows programmatically with ImageMagick micro-transforms — no Codex Pro, no $imagegen, no OPENAIAPIKEY required, only RUNCOMFYTOKEN. Triggers on "codex pet", "create codex pet", "make codex pet", "hatch codex pet", "/hatch image", "desktop pet codex", "codex pets", "spritesheet.webp", or any explicit ask to build a custom pet for OpenAI Codex.

AI & Agents402.1K installs

full-output-enforcement

leonxlnx/taste-skill

Overrides default LLM truncation behavior. Enforces complete code generation, bans placeholder patterns, and handles token-limit splits cleanly. Apply to any task requiring exhaustive, unabridged output.

AI & Agents401K installs

executing-plans

obra/superpowers

Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available

AI & Agents245.7K installs

http_mcp_headers

Install

Install

Describe the task

Review the result

SKILL.md

HTTP MCP Header Secret Support - Implementation Summary

Problem Statement

Example Workflow

Generated Output

1. MCP Config (mcp-config.json)

2. Execution Step Environment Variables

Implementation Details

Key Functions

Rendering Logic

In renderSharedMCPConfig (mcp-config.go):

In GetExecutionSteps (copilot_engine.go):

Security Benefits

Test Coverage

Unit Tests (mcp_http_headers_test.go)

Integration Tests (copilot_mcp_http_integration_test.go)

FAQ

More from github/gh-aw

github-mcp-server

javascript-refactoring

developer

debugging-workflows

agentic-workflows

github-pr-query

Popular ai & agents skills

google-agents-cli-publish

google-agents-cli-eval

skill-creator

codex-pet

full-output-enforcement

executing-plans