📮 feat: Custom OAuth Headers Support for MCP Server Config

[ruggishop]

Summary

This PR adds the ability to specify custom headers to be used in OAuth MCP server calls (e.g. register), defined in the oauth_headers key in the MCP options YAML config.

If that key is present it will be passed to the handler functions, which will include them in the fetch wrapper.

The reason for having a separate key completely outside of the oauth key is to ensure there's no risk of inadvertently storing/caching them as they might contain sensitive data.

Implementation note: a first draft implementation forwarded the main headers values in the OAuth calls instead of getting them from an extra key (the current oauth_headers), but after thinking a bit about it the extra key has a bunch of benefits:

• it does not leak secrets that may be OAuth-specific
• the MCP server and the OAuth provider are two separate things, so it makes sense to have split headers

Change Type

Please delete any irrelevant options.

• New feature (non-breaking change which adds functionality)

Testing

Added automated tests to make sure the headers are correctly passed down the chain.

Checklist

Please delete any irrelevant options.

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes
• A pull request for updating the documentation has been submitted. (docs: add OAuth headers section LibreChat-AI/librechat.ai#427)

[nhtruong]

This should be accompanied by a doc update for https://github.com/LibreChat-AI/librechat.ai
I cant deduce how to use this feature or how it should behave by looking at the code.

[ruggishop]

This should be accompanied by a doc update for https://github.com/LibreChat-AI/librechat.ai I cant deduce how to use this feature or how it should behave by looking at the code.

Good point @nhtruong , drafted the docs update in LibreChat-AI/librechat.ai#427

[nhtruong]

The code looks good to me.
How does this differ from the headers prop that the mcp config already accepts?
Also I think the example headers in the doc update should be more specific to oauth. X-Custom-Header-1 is too generic.

[ruggishop]

The code looks good to me. How does this differ from the headers prop that the mcp config already accepts?

The headers in the MCP config are not sent during the OAuth operations, and they imho should stay separate from them