AI SRE Agent MCP Authentication by Header: Keep Keys Out of the Config

Nobody wants an API key sitting in an agent's config file on a shared server. Mike shows how AURA takes the credential off the request instead.

Learn more about AURA → https://www.mezmo.com/aura
Get started today → https://github.com/mezmo/aura
Get deployment help → https://www.mezmo.com/contact

AURA can hold your keys in its config file, but it does not have to. Mike Shearer, one of AURA's creators, walks through the alternative: AURA reads named headers off the incoming request and forwards them to the MCP servers it calls, so the credential never has to sit on disk.

The mapping is one line in the MCP server's config. The GitHub MCP entry carries a headers from request block pairing Authorization with the incoming authorization header, so whatever arrives at AURA at request time is attached to the downstream call. Connect before that line is in place and the agent cannot authenticate to the GitHub MCP and reaches nothing. Restart with it in place, send the header, and the agent reports which GitHub capabilities it has and which it does not.

From your own framework this is an ordinary web request, and AURA supports any number of named headers. From the CLI there is an --api-key helper that passes the value through as an Authorization bearer, plus a second argument for defining headers more granularly. If a caller sends no headers at all, nothing is forwarded and the agent gets the same empty result it had before the config changed.

Mike names multi-tenant deploys and identity forwarding, where different users carry different permissions for downstream services, as what this makes possible for an SRE team. The video demonstrates the mechanism against a single GitHub MCP server; the multi-tenant case is described rather than shown.

For more detail, visit
https://www.mezmo.com/videos/mcp-authentication-by-header-for-an-ai-sre-agent-aura

0:00 Keeping keys out of the agent

0:28 Headers in the MCP server config

0:48 Why server-side and multi-tenant change the answer

1:11 The headers from request mapping

1:43 Connecting without the header

2:17 Writing the config and restarting

3:09 Sending the header with the API key helper

3:53 What the agent sees once the header arrives

4:20 Multi-tenant deploys and identity forwarding

4:50 Get AURA

#AURA #MCP #AISRE