From 4af4f8644d201c803d9e69e638dbd90bca8f3a5f Mon Sep 17 00:00:00 2001
From: davidmcwherter <cache@google.com>
Date: Mon, 10 Nov 2025 17:06:31 -0500
Subject: [PATCH] =?UTF-8?q?Fixes=20#12841:=20Plumb=20headers=20through=20g?=
 =?UTF-8?q?oogle=5Fcredentials=20transport=20crea=E2=80=A6=20(#12849)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: David McWherter <davidmcw@gmail.com>
---
 packages/core/src/tools/mcp-client.test.ts |  8 +++++
 packages/core/src/tools/mcp-client.ts      | 38 +++++++++++++++-------
 2 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/packages/core/src/tools/mcp-client.test.ts b/packages/core/src/tools/mcp-client.test.ts
index 14c134be0a..bf06e4179c 100644
--- a/packages/core/src/tools/mcp-client.test.ts
+++ b/packages/core/src/tools/mcp-client.test.ts
@@ -501,6 +501,9 @@ describe('mcp-client', () => {
             oauth: {
               scopes: ['scope1'],
             },
+            headers: {
+              'X-Goog-User-Project': 'myproject',
+            },
           },
           false,
         );
@@ -509,6 +512,11 @@ describe('mcp-client', () => {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const authProvider = (transport as any)._authProvider;
         expect(authProvider).toBeInstanceOf(GoogleCredentialProvider);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const googUserProject = (transport as any)._requestInit?.headers?.[
+          'X-Goog-User-Project'
+        ];
+        expect(googUserProject).toBe('myproject');
       });
 
       it('should use GoogleCredentialProvider with SSE transport', async () => {
diff --git a/packages/core/src/tools/mcp-client.ts b/packages/core/src/tools/mcp-client.ts
index 45e481390e..7b4ce0b1fd 100644
--- a/packages/core/src/tools/mcp-client.ts
+++ b/packages/core/src/tools/mcp-client.ts
@@ -394,6 +394,24 @@ async function handleAutomaticOAuth(
   }
 }
 
+/**
+ * Create RequestInit for TransportOptions.
+ *
+ * @param mcpServerConfig The MCP server configuration
+ * @param headers Additional headers
+ */
+function createTransportRequestInit(
+  mcpServerConfig: MCPServerConfig,
+  headers: Record<string, string>,
+): RequestInit {
+  return {
+    headers: {
+      ...mcpServerConfig.headers,
+      ...headers,
+    },
+  };
+}
+
 /**
  * Create a transport with OAuth token for the given server configuration.
  *
@@ -411,12 +429,9 @@ async function createTransportWithOAuth(
     if (mcpServerConfig.httpUrl) {
       // Create HTTP transport with OAuth token
       const oauthTransportOptions: StreamableHTTPClientTransportOptions = {
-        requestInit: {
-          headers: {
-            ...mcpServerConfig.headers,
-            Authorization: `Bearer ${accessToken}`,
-          },
-        },
+        requestInit: createTransportRequestInit(mcpServerConfig, {
+          Authorization: `Bearer ${accessToken}`,
+        }),
       };
 
       return new StreamableHTTPClientTransport(
@@ -426,12 +441,9 @@ async function createTransportWithOAuth(
     } else if (mcpServerConfig.url) {
       // Create SSE transport with OAuth token in Authorization header
       return new SSEClientTransport(new URL(mcpServerConfig.url), {
-        requestInit: {
-          headers: {
-            ...mcpServerConfig.headers,
-            Authorization: `Bearer ${accessToken}`,
-          },
-        },
+        requestInit: createTransportRequestInit(mcpServerConfig, {
+          Authorization: `Bearer ${accessToken}`,
+        }),
       });
     }
 
@@ -1170,6 +1182,7 @@ export async function createTransport(
     const transportOptions:
       | StreamableHTTPClientTransportOptions
       | SSEClientTransportOptions = {
+      requestInit: createTransportRequestInit(mcpServerConfig, {}),
       authProvider: provider,
     };
 
@@ -1197,6 +1210,7 @@ export async function createTransport(
     const transportOptions:
       | StreamableHTTPClientTransportOptions
       | SSEClientTransportOptions = {
+      requestInit: createTransportRequestInit(mcpServerConfig, {}),
       authProvider: provider,
     };
     if (mcpServerConfig.httpUrl) {