[iscekic]

Auxiliary header configuration now follows the same validation rules as static header configuration: names that identify transport-level metadata are refused, and message framing headers are refused for both header kinds. The upstream request builder independently skips those names in auxiliary input, so the two layers agree on what may reach a remote server.

Verification

• pnpm --filter @kilocode/mcp-gateway test: 46 passed (new cases cover refusal of transport identity names and content-length in both header maps, and the upstream builder skipping them in auxiliary input).
• pnpm --filter @kilocode/mcp-gateway typecheck: clean.
• pnpm --filter @kilocode/mcp-gateway lint: 0 warnings, 0 errors.

Proxy answers

The owner's proxy gave these answers in the owner's place.

1. Question: The finding mentions content-length (framing) as a candidate for the same rejection, but the approved work-item brief only requires transport identity rejection. How far should the new validation go?
   Answer: Mirror in static schema too
   Confidence: 0.50 · Precedent: Fix the root cause and the class of the issue on every affected surface: session 00eb2a1d3e4b, "if anything repeats the same mistake over and over again, fix the class"; also "if you saw a gap, fix it" (session 89824a222897)
2. Question: Framing rule: For the framing-header rule, which exact set and scope?
   Answer: content-length only, both schemas (Recommended)
   Confidence: 0.70 · Precedent: Do the least work possible with no drop in quality: session 00eb2a1d3e4b, "skip work that doesn't need to be done". transfer-encoding is already covered by the hop-by-hop rule, and content-type is legitimate.
3. Question: Static change: Confirm the static schema change is acceptable given existing configured static header data may include content-length.
   Answer: Accept behavior change (Recommended)
   Confidence: 0.65 · Precedent: Fix the root cause and the class of the issue on every affected surface: session 7f3470e0ba6f, "fix class of issue preventing progress". Parse errors already fail closed.
4. Question: Builder skip: Should buildUpstreamHeaders also skip transport identity and framing names at runtime, or rely on schema validation alone?
   Answer: Skip both (Recommended)
   Confidence: 0.75 · Precedent: Fix the root cause and the class of the issue: session 00eb2a1d3e4b, "if anything repeats the same mistake over and over again, fix the class". The brief also asks buildUpstreamHeaders to skip transport identity names, and a runtime guard for framing names covers callers that pass raw maps.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

The PR applies the existing transport-identity and framing-header rules consistently across the static and auxiliary header schemas and the upstream header builder, with matching unit tests. The change is additive and the two validation layers agree on what may reach the remote server.

Files Reviewed (2 files)

• packages/mcp-gateway/src/headers.ts
• packages/mcp-gateway/src/index.test.ts

---

_{Reviewed by deepseek-v4.1-flash · Input: 41.3K · Output: 5.6K · Cached: 249K}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

bot: Closing as superseded. The MCP Gateway package this branch modifies was removed from main in #8156 (commit 0763ba3c3d), and its database tables were dropped in #8157. The files this change targets no longer exist, so the change has no remaining target and the branch cannot be reconciled without restoring removed code.