Fix MCP authentication headers not forwarded for all tool calls

[bokelley]

Problem

Auth headers (x-adcp-auth) were inconsistently forwarded to MCP servers:

• ✅ get_products - Headers forwarded correctly
• ❌ sync_creatives - Headers NOT forwarded
  • Error: "Missing or invalid x-adcp-auth header"

Root Cause

Known bug in MCP TypeScript SDK where requestInit.headers are not properly merged for all HTTP requests:

• SDK Issues: #569, #436, #350
• While SDK PR #571 fixed _normalizeHeaders(), real-world testing showed headers were still inconsistently applied between tool calls

Solution

Implemented custom fetch function that intercepts ALL HTTP requests and ensures auth headers are included:

• ✅ Handles all request types (GET/POST/DELETE)
• ✅ Properly merges Headers objects, arrays, and plain objects
• ✅ Prioritizes auth headers over SDK defaults
• ✅ Works regardless of SDK internal code paths

Testing

Unit Tests ✅

• 5/5 tests pass
• Tests header merging, conversion, precedence
• Run: node --test test/unit/mcp-custom-fetch.test.js

Real Server Integration ✅

Tested against Wonderstruck MCP server:

• ✅ get_products - Auth headers present, no errors
• ✅ sync_creatives - Auth headers present, NO auth errors (fix verified!)
• ✅ Debug logs confirm headers in all HTTP requests

Build & Regression ✅

• ✅ TypeScript compiles successfully
• ✅ All existing tests still pass (6/6)
• ✅ No breaking changes

Changes

• src/lib/protocols/mcp.ts - Custom fetch function with header merging
• package-lock.json - Updated @modelcontextprotocol/sdk 1.18.1 → 1.18.2
• test/unit/mcp-custom-fetch.test.js - Unit tests for the fix
• FIX-AUTH-HEADERS.md - Comprehensive documentation
• TEST-RESULTS.md - Real server test results

Documentation

See FIX-AUTH-HEADERS.md for:

• Detailed problem analysis
• Solution explanation
• Alternative approaches considered (SDK authProvider, requestInit.headers)
• Testing results

🤖 Generated with Claude Code