auth-test-mcp-remote

Remote MCP server for verifying API key authentication header propagation.
Deployable to Render.com (free tier).

Purpose

Part of the custom API key header epic test suite.
Validates that WXO forwards the correct header name and value when a connection with api_key_auth (and a custom label) is linked to a remote MCP toolkit.

Tools

Tool	Auth required	What it returns
`ping`	No	Server name + `API_KEY_HEADER_NAME` currently configured
`get_api_key_variables`	Yes	Env vars containing `API`, `KEY`, or `TOKEN`
`echo_headers`	Yes	All inbound HTTP request headers — primary verification tool
`echo_query_and_cookies`	Yes	Inbound query params and cookies (for cookie/query location tests)

Environment variables

Variable	Default	Description
`API_KEY_HEADER_NAME`	`x-api-key`	Header name the server expects in inbound requests
`EXPECTED_API_KEY`	(empty)	If set, validates the incoming key strictly — leave blank to accept any key
`HOST`	`0.0.0.0`	Bind address
`PORT`	`8000`	Bind port (Render injects `10000` automatically)

Endpoints

Path	Description
`/sse`	SSE transport (for WXO connection)
`/messages/`	MCP post-handshake POST endpoint
`/health`	Health check (no auth)

Deploying to Render.com (free tier)

Step 1 — Put the server in its own GitHub repository

Render deploys from a Git repo. The easiest approach is to push just this folder as a standalone repository.

cd agentic_data/test_case_files/z_api_key_custom_header/mcp_servers/auth_test_mcp_remote

git init
git add .
git commit -m "feat: auth-test-mcp-remote initial commit"

# Create a new repo on github.com first, then:
git remote add origin https://github.com/YOUR_USERNAME/auth-test-mcp-remote.git
git branch -M main
git push -u origin main

Step 2 — Create a Web Service on Render

Go to dashboard.render.com → New + → Web Service
Connect your GitHub account and select the auth-test-mcp-remote repository
Render will auto-detect render.yaml and pre-fill:
- Environment: Python
- Build command: pip install -e .
- Start command: auth-test-mcp-remote
- Port: 10000
Set the EXPECTED_API_KEY secret in the Environment tab (the value WXO will send in the header)
Click Create Web Service

Render assigns a public HTTPS URL like:

https://remote-mcp-server-sk0z.onrender.com

Step 3 — Verify the deployment

# Health check
curl https://remote-mcp-server-sk0z.onrender.com/health

# Expected:
# {"status":"healthy","service":"auth-test-mcp-remote","version":"0.1.0",
#  "implementation":"FastMCP","api_key_header":"x-api-key"}

Free tier note: Render spins down free services after 15 min of inactivity. The first request after sleep takes ~30–60 s. WXO's 30 s import timeout may trip during a cold start — hit the health endpoint once to warm it up before running orchestrate toolkits add.

Importing into WXO (after deployment)

Option A — `orchestrate toolkits add` (one-liner)

# Create and configure the connection first
orchestrate connections add -a auth_test_remote
for env in draft live; do
    orchestrate connections configure -a auth_test_remote --env $env --type team --kind key_value
    orchestrate connections set-credentials -a auth_test_remote --env $env \
        -e "EXPECTED_API_KEY=<your-secret-key>"
done

# Import the toolkit
orchestrate toolkits add \
  --kind mcp \
  --name auth_test_mcp_remote \
  --description "Remote MCP server for API key authentication testing" \
  --url "https://remote-mcp-server-sk0z.onrender.com/sse" \
  --transport sse \
  --tools "*" \
  --app-id auth_test_remote

Option B — Import from YAML file

Create auth_test_mcp_remote.yaml:

spec_version: v1
kind: mcp
name: auth_test_mcp_remote
transport: sse
server_url: https://remote-mcp-server-sk0z.onrender.com/sse
tools:
  - "*"
connections:
  - auth_test_remote

Then run:

orchestrate toolkits import -f auth_test_mcp_remote.yaml -a auth_test_remote

Running locally

pip install -e .

# Default header (x-api-key), no strict validation
auth-test-mcp-remote

# Custom header + strict validation
API_KEY_HEADER_NAME=x-custom-auth EXPECTED_API_KEY=mysecret auth-test-mcp-remote

# Or with Docker
docker-compose up

After deploying — update `mcp_config_example.json`

{
  "mcpServers": {
    "auth-test-remote": {
      "url": "https://remote-mcp-server-sk0z.onrender.com/sse",
      "headers": {
        "x-api-key": "<your-secret-key>"
      }
    }
  }
}