Repository navigation
Send the duckdb-mcp Bearer token from headless runs - #161
Merged
Merged
Conversation
The public duckdb-mcp endpoints require a token since geo-query#453, and the runner had no way to send one, so every cell exited rc=1 within seconds. run.js reads MCP_AUTH_TOKEN (or config.mcp_auth_token) and passes it to the MCP client as a Bearer header; it is never logged. A 401 now exits 3 with a clear message instead of an unexplained crash. The matrix Job mounts the token from the duckdb-mcp-auth Secret (optional).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since 2026-11-07 the public MCP endpoints (duckdb-mcp, dev-duckdb-mcp, experimental-duckdb-mcp, ca30x30-mcp) return 401 without
Authorization: Bearer <token>(SchmidtDSE/geo-query#453). Every matrix cell therefore exited rc=1 within seconds.run.jsreadsMCP_AUTH_TOKEN(orconfig.mcp_auth_token) and sends it as a Bearer header. The token is never logged or written to the transcript. A 401 now exits 3 with a clear message.matrix-job.yamlmounts the token from Secretduckdb-mcp-auth(keyMCP_AUTH_TOKEN, optional).headless/README.mddocument the variable.Most headless benchmarking is moving to geo-agent-benchmark (#91). That repo's runner needs the same token.
Test
One-cell matrix Job
hmx-geo-agent-template-mcpauth-test-20261107-022418withPROXY_BRANCH=headless-mcp-auth-token,MCP_URL=https://duckdb-mcp.nrp-nautilus.io/mcp(mcp-data-server v0.9.2), modelqwen3. The cell completed in 70 s with 5 tool calls (get_schema,query), no error and no 401.