fix: forward passthrough headers to composite MCP children

[jsguerrero]

What

constructMCPServerNanobotYAMLForComposite now threads the composite server's
configured PassthroughHeaderNames to each child, and always includes
Authorization (deduped, case-insensitive). The two call sites (docker.go,
kubernetes.go) pass server.PassthroughHeaderNames.

func constructMCPServerNanobotYAMLForComposite(servers []ComponentServer, passthroughHeaderNames []string) ([]byte, error)

Why

Composite MCP servers did not propagate per-request auth to their child servers:
the composite branch only set BaseURL/ToolOverrides/ToolPrefix per child,
while the non-composite path already forwards PassthroughHeaderNames. As a
result the child never received the inbound bearer and downstream calls failed
with "access token missing".

Composite children are internal Obot /mcp-connect endpoints that resolve the
caller's per-user credentials, so forwarding Authorization only ever crosses
an Obot→Obot hop and lets each child authenticate as the calling user. This
makes the composite path consistent with the non-composite one.

Fixes #6845

Tests

TestCompositeNanobotYAMLForwardsAuthHeaders (table-driven):

• default adds Authorization
• operator-configured names are forwarded plus Authorization
• Authorization is not duplicated when already configured

make validate (gofmt, go vet, go test ./...) passes.

[Copilot]

Pull request overview

This PR fixes composite MCP server behavior so that request header passthrough (notably per-request auth context) is propagated from a composite nanobot proxy to each of its child MCP servers, aligning composite behavior with the existing non-composite nanobot config path.

Changes:

• Extend constructMCPServerNanobotYAMLForComposite to accept passthrough header names and apply them to each child server entry in the generated nanobot YAML.
• Ensure Authorization is always included in the composite-to-child passthrough allowlist (case-insensitive, no additional duplicate added).
• Update docker + Kubernetes backends to pass server.PassthroughHeaderNames, and add a table-driven unit test covering the intended header forwarding behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
pkg/mcp/kubernetes.go	Passes composite server passthrough header names into composite nanobot YAML construction.
pkg/mcp/docker.go	Passes composite server passthrough header names into composite nanobot YAML construction.
pkg/mcp/backend.go	Threads passthrough headers into composite child configs and ensures Authorization is included.
pkg/mcp/backend_test.go	Adds TestCompositeNanobotYAMLForwardsAuthHeaders to validate forwarding + dedup behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[entelligence-ai-pr-reviews]

EntelligenceAI PR Summary

Adds Authorization header forwarding to composite MCP server Nanobot YAML generation to ensure per-user credential resolution on internal /mcp-connect endpoints (issue #6845).

• pkg/mcp/backend.go: Extended constructMCPServerNanobotYAMLForComposite with a passthroughHeaderNames []string param; guarantees Authorization is included via merge logic before assigning to each child's PassthroughHeaders
• pkg/mcp/docker.go & pkg/mcp/kubernetes.go: Updated call sites to forward server.PassthroughHeaderNames to the updated function signature
• pkg/mcp/backend_test.go: New test covers Authorization injection, case-insensitive deduplication of merged headers, and introduces containsFold helper

---

Confidence Score: 5/5 - Safe to Merge

Safe to merge — this PR correctly addresses issue #6845 by extending constructMCPServerNanobotYAMLForComposite with a passthroughHeaderNames parameter and ensuring Authorization is always included via merge logic before assigning to child PassthroughHeaders. The implementation is consistent across both call sites in pkg/mcp/docker.go and pkg/mcp/kubernetes.go, and the header forwarding approach is appropriately conservative by guaranteeing the Authorization header is present regardless of caller input. No review comments were generated and all four changed files were reviewed with no issues identified.

Key Findings:

• constructMCPServerNanobotYAMLForComposite in backend.go correctly merges caller-provided passthroughHeaderNames with a guaranteed Authorization header, preventing credential resolution failures on internal /mcp-connect endpoints without risking accidental omission.
• Both call sites in docker.go and kubernetes.go were updated consistently to forward the server's passthrough headers, maintaining behavioral parity across deployment environments.
• The PR is narrowly scoped — it does not introduce new abstractions, side effects, or behavior changes beyond the targeted header forwarding fix, reducing regression risk.

Files requiring special attention

• pkg/mcp/backend.go
• pkg/mcp/docker.go
• pkg/mcp/kubernetes.go

[jsguerrero]

Cross-repo context: this passthrough change is part of enabling per-user OAuth brokering to lazy-auth SaaS MCPs through composite servers. It pairs with obot-platform/nanobot#332 (lazy-auth: OAuth required without a 401 challenge). The obot-side wiring that sets Server.OAuthRequired for static-OAuth composite components will follow once #332 is released.