# auth-test-mcp-remote

Remote MCP server for verifying API key authentication header propagation.  
Deployable to [Render.com](https://render.com) (free tier).

## Purpose

Part of the **custom API key header** epic test suite.  
Validates that WXO forwards the correct header name and value when a connection
with `api_key_auth` (and a custom label) is linked to a remote MCP toolkit.

## Tools

| Tool | Auth required | What it returns |
|---|---|---|
| `ping` | No | Server name + `API_KEY_HEADER_NAME` currently configured |
| `get_api_key_variables` | Yes | Env vars containing `API`, `KEY`, or `TOKEN` |
| `echo_headers` | Yes | **All inbound HTTP request headers** — primary verification tool |
| `echo_query_and_cookies` | Yes | Inbound query params and cookies (for cookie/query location tests) |

## Environment variables

| Variable | Default | Description |
|---|---|---|
| `API_KEY_HEADER_NAME` | `x-api-key` | Header name the server expects in inbound requests |
| `EXPECTED_API_KEY` | _(empty)_ | If set, validates the incoming key strictly — leave blank to accept any key |
| `HOST` | `0.0.0.0` | Bind address |
| `PORT` | `8000` | Bind port (Render injects `10000` automatically) |

## Endpoints

| Path | Description |
|---|---|
| `/sse` | SSE transport (for WXO connection) |
| `/messages/` | MCP post-handshake POST endpoint |
| `/health` | Health check (no auth) |

---

## Deploying to Render.com (free tier)

### Step 1 — Put the server in its own GitHub repository

Render deploys from a Git repo.  The easiest approach is to push
**just this folder** as a standalone repository.

```bash
cd agentic_data/test_case_files/z_api_key_custom_header/mcp_servers/auth_test_mcp_remote

git init
git add .
git commit -m "feat: auth-test-mcp-remote initial commit"

# Create a new repo on github.com first, then:
git remote add origin https://github.com/YOUR_USERNAME/auth-test-mcp-remote.git
git branch -M main
git push -u origin main
```

### Step 2 — Create a Web Service on Render

1. Go to [dashboard.render.com](https://dashboard.render.com) → **New +** → **Web Service**
2. Connect your GitHub account and select the `auth-test-mcp-remote` repository
3. Render will auto-detect **`render.yaml`** and pre-fill:
   - **Environment**: Python
   - **Build command**: `pip install -e .`
   - **Start command**: `auth-test-mcp-remote`
   - **Port**: 10000
4. Set the **`EXPECTED_API_KEY`** secret in the *Environment* tab (the value WXO will send in the header)
5. Click **Create Web Service**

Render assigns a public HTTPS URL like:

```
https://remote-mcp-server-sk0z.onrender.com
```

### Step 3 — Verify the deployment

```bash
# Health check
curl https://remote-mcp-server-sk0z.onrender.com/health

# Expected:
# {"status":"healthy","service":"auth-test-mcp-remote","version":"0.1.0",
#  "implementation":"FastMCP","api_key_header":"x-api-key"}
```

> **Free tier note**: Render spins down free services after 15 min of inactivity.
> The first request after sleep takes ~30–60 s.  WXO's 30 s import timeout may
> trip during a cold start — hit the health endpoint once to warm it up before running `orchestrate toolkits add`.

---

## Importing into WXO (after deployment)

### Option A — `orchestrate toolkits add` (one-liner)

```bash
# Create and configure the connection first
orchestrate connections add -a auth_test_remote
for env in draft live; do
    orchestrate connections configure -a auth_test_remote --env $env --type team --kind key_value
    orchestrate connections set-credentials -a auth_test_remote --env $env \
        -e "EXPECTED_API_KEY=<your-secret-key>"
done

# Import the toolkit
orchestrate toolkits add \
  --kind mcp \
  --name auth_test_mcp_remote \
  --description "Remote MCP server for API key authentication testing" \
  --url "https://remote-mcp-server-sk0z.onrender.com/sse" \
  --transport sse \
  --tools "*" \
  --app-id auth_test_remote
```

### Option B — Import from YAML file

Create `auth_test_mcp_remote.yaml`:

```yaml
spec_version: v1
kind: mcp
name: auth_test_mcp_remote
transport: sse
server_url: https://remote-mcp-server-sk0z.onrender.com/sse
tools:
  - "*"
connections:
  - auth_test_remote
```

Then run:

```bash
orchestrate toolkits import -f auth_test_mcp_remote.yaml -a auth_test_remote
```

---

## Running locally

```bash
pip install -e .

# Default header (x-api-key), no strict validation
auth-test-mcp-remote

# Custom header + strict validation
API_KEY_HEADER_NAME=x-custom-auth EXPECTED_API_KEY=mysecret auth-test-mcp-remote

# Or with Docker
docker-compose up
```

## After deploying — update `mcp_config_example.json`

```json
{
  "mcpServers": {
    "auth-test-remote": {
      "url": "https://remote-mcp-server-sk0z.onrender.com/sse",
      "headers": {
        "x-api-key": "<your-secret-key>"
      }
    }
  }
}
```