lemura 1.4.0 → 1.4.1

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.1] - 2026-05-07
+
+### Added
+
+- **MCP Custom Headers**: `MCPServerConfig` now supports a `headers` field for `http` and `sse` transports. This allows passing custom headers (e.g., `Authorization: Bearer <token>`) to remote MCP servers.
+
+### Fixed
+
+- **MCP HTTP Authentication**: `MCPClient` now correctly includes custom headers from the server configuration in all JSON-RPC calls and initialization notifications, fixing issues where authenticated MCP servers would return 401 Unauthorized.
+
 ## [1.4.0] - 2026-03-14
 
 ### Added

package/README.md

@@ -14,11 +14,11 @@
 
 `lemura` is a robust, provider-agnostic npm package designed to encapsulate a full agentic AI runtime. It simplifies the complex orchestration of LLMs, tools, and context management into a single, cohesive interface.
 
-### ✨ Key Features in v1.4.0
+### ✨ Key Features in v1.4.1
 - **🧠 Dynamic Skill Market**: Switch skills on/off at runtime via tags, names, or tool dependencies.
 - **🗺️ Continuation Planning**: Multi-step tool chains with parallel execution and conditional logic.
 - **🎯 Intelligent Goal Maintenance**: LLM-powered sub-goal decomposition and status tracking.
-- **🔌 MCP Support**: Native Model Context Protocol integration for connecting to external tool servers.
+- **🔌 MCP Support**: Native Model Context Protocol integration with **custom header support** (auth).
 - **🛡️ Tool Firewall**: Fully integrated ask/accept/deny policy layer for security.
 - **⚡ Parallel Tool Calls**: Execute independent tools concurrently for reduced latency.
 - **🧹 Summary Injection**: ensures the model never "forgets" what was compressed away.

package/dist/{agent-38El9_yp.d.ts → agent-DTcDIKIn.d.ts}

@@ -55,6 +55,11 @@ interface MCPServerConfig {
      * `{ GITHUB_TOKEN: process.env.GITHUB_TOKEN! }`
      */
     env?: Record<string, string>;
+    /**
+     * For `http`/`sse`: custom headers to include in requests.
+     * @example { Authorization: 'Bearer <token>' }
+     */
+    headers?: Record<string, string>;
     /**
      * Per-call timeout in milliseconds. Defaults to `30_000`.
      */

package/dist/{agent-CJvmcAbT.d.mts → agent-DfN5nNXc.d.mts}

@@ -55,6 +55,11 @@ interface MCPServerConfig {
      * `{ GITHUB_TOKEN: process.env.GITHUB_TOKEN! }`
      */
     env?: Record<string, string>;
+    /**
+     * For `http`/`sse`: custom headers to include in requests.
+     * @example { Authorization: 'Bearer <token>' }
+     */
+    headers?: Record<string, string>;
     /**
      * Per-call timeout in milliseconds. Defaults to `30_000`.
      */

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { a as IProviderAdapter, T as TranscriptionRequest, d as TranscriptionResponse, e as SynthesisRequest, A as AudioChunk, V as VisionRequest, f as VisionResponse, g as ImageGenRequest, h as ImageGenResponse, M as ModelInfo, C as ContextWindow, i as Turn, j as ContentBlock, I as IToolDefinition } from './adapters-BhTAnrOM.mjs';
 export { k as CompletionChunk, l as CompletionRequest, m as CompletionResponse, b as IContextStrategy, c as IScratchpadAdapter, n as IStorageAdapter, N as NormalizedMessage, o as STMItem, p as STMRegistryConfig, S as ShortTermMemoryRegistry, q as TokenUsage, r as ToolCall, s as ToolContext, t as ToolResult } from './adapters-BhTAnrOM.mjs';
-import { S as SessionConfig, I as IToolResponseProcessor, T as ToolResponseEvaluation, M as MCPServerConfig, a as MCPToolDefinition } from './agent-CJvmcAbT.mjs';
-export { b as MCPJsonRpcRequest, c as MCPJsonRpcResponse, d as MCPTransportType, e as MediaConfig, f as ToolDecision, g as ToolExecutionBudget, h as ToolFirewallConfig, i as ToolFirewallRule, j as TraceEvent } from './agent-CJvmcAbT.mjs';
+import { S as SessionConfig, I as IToolResponseProcessor, T as ToolResponseEvaluation, M as MCPServerConfig, a as MCPToolDefinition } from './agent-DfN5nNXc.mjs';
+export { b as MCPJsonRpcRequest, c as MCPJsonRpcResponse, d as MCPTransportType, e as MediaConfig, f as ToolDecision, g as ToolExecutionBudget, h as ToolFirewallConfig, i as ToolFirewallRule, j as TraceEvent } from './agent-DfN5nNXc.mjs';
 export { LemuraAdapterError, LemuraContextOverflowError, LemuraError, LemuraMCPConnectionError, LemuraMCPError, LemuraMCPTimeoutError, LemuraMaxIterationsError, LemuraSkillInjectionError, LemuraToolNotFoundError, LemuraToolTimeoutError, LemuraToolValidationError } from './types/index.mjs';
 import { I as ILogger } from './logger-DxvKliuk.mjs';
 export { L as LogLevel, a as LogMetadata, S as Severity } from './logger-DxvKliuk.mjs';

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { a as IProviderAdapter, T as TranscriptionRequest, d as TranscriptionResponse, e as SynthesisRequest, A as AudioChunk, V as VisionRequest, f as VisionResponse, g as ImageGenRequest, h as ImageGenResponse, M as ModelInfo, C as ContextWindow, i as Turn, j as ContentBlock, I as IToolDefinition } from './adapters-CVcfWf85.js';
 export { k as CompletionChunk, l as CompletionRequest, m as CompletionResponse, b as IContextStrategy, c as IScratchpadAdapter, n as IStorageAdapter, N as NormalizedMessage, o as STMItem, p as STMRegistryConfig, S as ShortTermMemoryRegistry, q as TokenUsage, r as ToolCall, s as ToolContext, t as ToolResult } from './adapters-CVcfWf85.js';
-import { S as SessionConfig, I as IToolResponseProcessor, T as ToolResponseEvaluation, M as MCPServerConfig, a as MCPToolDefinition } from './agent-38El9_yp.js';
-export { b as MCPJsonRpcRequest, c as MCPJsonRpcResponse, d as MCPTransportType, e as MediaConfig, f as ToolDecision, g as ToolExecutionBudget, h as ToolFirewallConfig, i as ToolFirewallRule, j as TraceEvent } from './agent-38El9_yp.js';
+import { S as SessionConfig, I as IToolResponseProcessor, T as ToolResponseEvaluation, M as MCPServerConfig, a as MCPToolDefinition } from './agent-DTcDIKIn.js';
+export { b as MCPJsonRpcRequest, c as MCPJsonRpcResponse, d as MCPTransportType, e as MediaConfig, f as ToolDecision, g as ToolExecutionBudget, h as ToolFirewallConfig, i as ToolFirewallRule, j as TraceEvent } from './agent-DTcDIKIn.js';
 export { LemuraAdapterError, LemuraContextOverflowError, LemuraError, LemuraMCPConnectionError, LemuraMCPError, LemuraMCPTimeoutError, LemuraMaxIterationsError, LemuraSkillInjectionError, LemuraToolNotFoundError, LemuraToolTimeoutError, LemuraToolValidationError } from './types/index.js';
 import { I as ILogger } from './logger-DxvKliuk.js';
 export { L as LogLevel, a as LogMetadata, S as Severity } from './logger-DxvKliuk.js';

package/dist/index.js

@@ -2280,7 +2280,11 @@ var MCPClient = class {
     try {
       const res = await fetch(url, {
         method: "POST",
-        headers: { "Content-Type": "application/json", "Accept": "application/json" },
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json",
+          ...this.config.headers
+        },
         body: JSON.stringify(request),
         signal: controller.signal
       });
@@ -2339,7 +2343,10 @@ var MCPClient = class {
     } else if (this.config.transport !== "stdio") {
       fetch(this.config.url, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          "Content-Type": "application/json",
+          ...this.config.headers
+        },
         body: initializedNotif
       }).catch(() => {
       });