fix: include API key in CORS proxy requests for MCP connections

[satishkc7]

Problem

When llama-server is started with both --api-key-file and --webui-mcp-proxy, the /cors-proxy endpoint is subject to the global API key validation middleware. MCP connections configured with "Use Proxy" fail with a 401 because the WebUI does not include the Authorization header in its requests to /cors-proxy.

Fixes #21167

Root Cause

In MCPService.createTransport(), requestInit.headers was only populated with buildProxiedHeaders(config.headers) — which wraps the target MCP server's headers using the X-Proxy-Header-* convention. The Authorization: Bearer <api-key> header needed to authenticate the request against llama-server itself was never included.

Fix

Import the existing getAuthHeaders() utility and spread it into requestInit.headers when useProxy is true:

if (useProxy) {
    requestInit.headers = {
        ...getAuthHeaders(),
        ...(requestInit.headers as Record<string, string>)
    };
}

getAuthHeaders() returns { Authorization: 'Bearer <key>' } when an API key is configured, or an empty object otherwise — so there is no regression when no API key is set.

Testing

1. Start llama-server with --api-key-file <file> --webui-mcp-proxy
2. Authenticate with the WebUI using the API key
3. Add an MCP server with "Use Proxy" enabled
4. Connection succeeds (previously failed with 401)

[ggml-gh-bot]

Hi @satishkc7, thanks for your contribution!

Per our contribution guidelines, the automated PR checker found the following issue(s) that need your attention:

• AI-generated content: This project does not accept PRs, descriptions or commit messages that are fully or predominantly AI-generated. If you have used AI to assist you in writing code, please make sure to disclose that explicitly.

---

Please note that maintainers reserve the right to make final decisions on PRs. If you believe there is a mistake, please comment below.

[ngxson]

it seems to be a mistake from my #21072 , it seems like the fix is to simply:

Suggested change

	if (config.headers) {
	requestInit.headers = config.useProxy ? buildProxiedHeaders(config.headers) : config.headers;
	}

could you confirm? cc @allozaur too

[satishkc7]

Thanks for the note. The fix was written by me - I traced the issue through createTransport() in mcp.service.ts, identified that requestInit.headers was never populated with the auth header for the proxy request itself, and wrote the change. Happy to discuss the implementation directly with reviewers.

[satishkc7]

Good catch, that's cleaner. I'll update the PR with your suggestion.