multicorn-shield 1.3.5 → 1.3.6

package/CHANGELOG.md

@@ -9,6 +9,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Bump `version` in `package.json` before publishing to npm.
 
+## [1.3.6] - 2026-05-08
+
+### Fixed
+
+- Hosted proxy URLs now embed the API key as a query parameter fallback for MCP clients that don't send static Authorization headers (fixes Cursor, Claude Desktop, and other clients that ignore the headers config during discovery)
+
 ## [1.3.5] - 2026-05-08
 
 ### Fixed

package/dist/multicorn-proxy.js

@@ -1564,6 +1564,41 @@ async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverNa
   const data = envelope["data"];
   return typeof data?.["proxy_url"] === "string" ? data["proxy_url"] : "";
 }
+function shouldEmbedKeyInHostedProxyUrl(platform) {
+  return HOSTED_PROXY_PLATFORMS_WITH_URL_KEY.has(platform);
+}
+function hostedProxyUrlWithKeyParam(proxyUrl, apiKey) {
+  if (apiKey.length === 0) {
+    process.stderr.write(
+      style.yellow("\u26A0") + " Could not add key to proxy URL: API key is empty; using URL without key query parameter.\n"
+    );
+    return proxyUrl;
+  }
+  try {
+    const u = new URL(proxyUrl);
+    u.searchParams.set("key", apiKey);
+    return u.toString();
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      style.yellow("\u26A0") + " Could not parse proxy URL to append key query parameter; using URL unchanged. " + style.dim(detail) + "\n"
+    );
+    return proxyUrl;
+  }
+}
+function formatHostedProxyUrlForStderr(platform, proxyUrl, apiKey) {
+  if (!shouldEmbedKeyInHostedProxyUrl(platform) || apiKey.length === 0) {
+    return proxyUrl;
+  }
+  try {
+    const u = new URL(proxyUrl);
+    const redactedLabel = apiKey.length <= 4 ? "****" : `mcs_...${apiKey.slice(-4)}`;
+    u.searchParams.set("key", redactedLabel);
+    return u.toString();
+  } catch {
+    return proxyUrl;
+  }
+}
 function writeMcpAddedLine(shortName, filePath) {
   process.stderr.write(
     style.green("\u2713") + ' MCP server "' + shortName + '" added to ' + style.cyan(filePath) + "\n"
@@ -1713,8 +1748,9 @@ function printHostedProxyPostWriteHints(platform, shortName) {
 }
 async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey, workspacePath) {
   const authHeader = `Bearer ${apiKey}`;
+  const proxyUrlWithKeyWhenNeeded = shouldEmbedKeyInHostedProxyUrl(platform) ? hostedProxyUrlWithKeyParam(proxyUrl, apiKey) : proxyUrl;
   if (platform === "gemini-cli") {
-    await mergeGeminiHostedMcpServersIntoSettings(shortName, proxyUrl, apiKey);
+    await mergeGeminiHostedMcpServersIntoSettings(shortName, proxyUrlWithKeyWhenNeeded, apiKey);
     process.stderr.write(
       style.dim(
         "For project-specific config, copy the mcpServers entry into .gemini/settings.json in your project root. Restart Gemini CLI if it is already running."
@@ -1739,20 +1775,24 @@ async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey,
     let result = "parse-error";
     if (platform === "cursor") {
       result = await mergeMcpServersObjectStyle(getCursorMcpJsonPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getCursorMcpJsonPath());
       }
     } else if (platform === "claude-desktop") {
-      result = await mergeClaudeDesktopHostedMcpRemote(shortName, proxyUrl, apiKey);
+      result = await mergeClaudeDesktopHostedMcpRemote(
+        shortName,
+        proxyUrlWithKeyWhenNeeded,
+        apiKey
+      );
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getClaudeDesktopConfigPath());
       }
     } else if (platform === "windsurf") {
       result = await mergeMcpServersObjectStyle(getWindsurfMcpConfigPath(), shortName, {
-        serverUrl: proxyUrl,
+        serverUrl: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
@@ -1760,25 +1800,30 @@ async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey,
       }
     } else if (platform === "cline") {
       result = await mergeMcpServersObjectStyle(getClineMcpSettingsPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getClineMcpSettingsPath());
       }
     } else if (platform === "kilo-code") {
-      result = await mergeKiloCodeProjectMcp(workspacePath, shortName, proxyUrl, apiKey);
+      result = await mergeKiloCodeProjectMcp(
+        workspacePath,
+        shortName,
+        proxyUrlWithKeyWhenNeeded,
+        apiKey
+      );
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(join(workspacePath, ".kilocode", "mcp.json"));
       }
     } else if (platform === "continue-dev") {
-      result = await mergeContinueHostedMcp(shortName, proxyUrl, apiKey);
+      result = await mergeContinueHostedMcp(shortName, proxyUrlWithKeyWhenNeeded, apiKey);
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getContinueConfigJsonPath());
       }
     } else {
       result = await mergeMcpServersObjectStyle(getCursorMcpJsonPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
@@ -1823,6 +1868,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
   ]);
   const usesInlineKey = hostedInlinePlatforms.has(platform);
   const authHeader = usesInlineKey ? `Bearer ${apiKey}` : "Bearer YOUR_SHIELD_API_KEY";
+  const urlInSnippet = usesInlineKey && shouldEmbedKeyInHostedProxyUrl(platform) ? hostedProxyUrlWithKeyParam(routingToken, apiKey) : routingToken;
   let snippetText;
   if (platform === "github-copilot") {
     snippetText = JSON.stringify(
@@ -1831,7 +1877,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
           servers: {
             [shortName]: {
               type: "http",
-              url: routingToken,
+              url: urlInSnippet,
               headers: {
                 Authorization: authHeader
               }
@@ -1843,13 +1889,13 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       2
     );
   } else if (platform === "goose") {
-    snippetText = gooseHostedProxyYaml(shortName, routingToken, authHeader);
+    snippetText = gooseHostedProxyYaml(shortName, urlInSnippet, authHeader);
   } else if (platform === "gemini-cli") {
     snippetText = JSON.stringify(
       {
         mcpServers: {
           [shortName]: {
-            httpUrl: routingToken,
+            httpUrl: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1865,7 +1911,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
         mcpServers: {
           [shortName]: {
             command: "npx",
-            args: ["-y", "mcp-remote", routingToken, "--header", `Authorization: ${authHeader}`]
+            args: ["-y", "mcp-remote", urlInSnippet, "--header", `Authorization: ${authHeader}`]
           }
         }
       },
@@ -1879,7 +1925,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
           {
             name: shortName,
             type: "streamable-http",
-            url: routingToken,
+            url: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1895,7 +1941,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       {
         mcpServers: {
           [shortName]: {
-            [urlKey]: routingToken,
+            [urlKey]: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -2426,7 +2472,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2517,7 +2565,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2602,7 +2652,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2650,7 +2702,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
       }
       if (created && proxyUrl.length > 0) {
         process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-        process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+        process.stderr.write(
+          "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+        );
         await applyHostedProxyMcpConfig(
           selectedPlatform,
           proxyUrl,
@@ -2831,7 +2885,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
   }
   return lastConfig;
 }
-var SECRET_JSON_FILE_OPTIONS, style, BANNER, NativePluginPrerequisiteMissingError, CONFIG_DIR, CONFIG_PATH, OPENCLAW_CONFIG_PATH, ANSI_PATTERN, OPENCLAW_MIN_VERSION, INIT_WIZARD_PLATFORM_REGISTRY, INIT_WIZARD_MENU_SECTIONS, INIT_WIZARD_SELECTION_MAX, PLATFORM_BY_SELECTION, DEFAULT_SHIELD_API_BASE_URL;
+var SECRET_JSON_FILE_OPTIONS, style, BANNER, NativePluginPrerequisiteMissingError, CONFIG_DIR, CONFIG_PATH, OPENCLAW_CONFIG_PATH, ANSI_PATTERN, OPENCLAW_MIN_VERSION, INIT_WIZARD_PLATFORM_REGISTRY, INIT_WIZARD_MENU_SECTIONS, INIT_WIZARD_SELECTION_MAX, PLATFORM_BY_SELECTION, HOSTED_PROXY_PLATFORMS_WITH_URL_KEY, DEFAULT_SHIELD_API_BASE_URL;
 var init_config = __esm({
   "src/proxy/config.ts"() {
     init_consent();
@@ -2922,6 +2976,14 @@ var init_config = __esm({
     PLATFORM_BY_SELECTION = Object.fromEntries(
       INIT_WIZARD_PLATFORM_REGISTRY.map((e, i) => [i + 1, e.slug])
     );
+    HOSTED_PROXY_PLATFORMS_WITH_URL_KEY = /* @__PURE__ */ new Set([
+      "cursor",
+      "claude-desktop",
+      "github-copilot",
+      "kilo-code",
+      "continue-dev",
+      "goose"
+    ]);
     DEFAULT_SHIELD_API_BASE_URL = "https://api.multicorn.ai";
   }
 });

package/dist/multicorn-shield.js

@@ -1635,6 +1635,49 @@ async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverNa
   const data = envelope["data"];
   return typeof data?.["proxy_url"] === "string" ? data["proxy_url"] : "";
 }
+var HOSTED_PROXY_PLATFORMS_WITH_URL_KEY = /* @__PURE__ */ new Set([
+  "cursor",
+  "claude-desktop",
+  "github-copilot",
+  "kilo-code",
+  "continue-dev",
+  "goose"
+]);
+function shouldEmbedKeyInHostedProxyUrl(platform) {
+  return HOSTED_PROXY_PLATFORMS_WITH_URL_KEY.has(platform);
+}
+function hostedProxyUrlWithKeyParam(proxyUrl, apiKey) {
+  if (apiKey.length === 0) {
+    process.stderr.write(
+      style.yellow("\u26A0") + " Could not add key to proxy URL: API key is empty; using URL without key query parameter.\n"
+    );
+    return proxyUrl;
+  }
+  try {
+    const u = new URL(proxyUrl);
+    u.searchParams.set("key", apiKey);
+    return u.toString();
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      style.yellow("\u26A0") + " Could not parse proxy URL to append key query parameter; using URL unchanged. " + style.dim(detail) + "\n"
+    );
+    return proxyUrl;
+  }
+}
+function formatHostedProxyUrlForStderr(platform, proxyUrl, apiKey) {
+  if (!shouldEmbedKeyInHostedProxyUrl(platform) || apiKey.length === 0) {
+    return proxyUrl;
+  }
+  try {
+    const u = new URL(proxyUrl);
+    const redactedLabel = apiKey.length <= 4 ? "****" : `mcs_...${apiKey.slice(-4)}`;
+    u.searchParams.set("key", redactedLabel);
+    return u.toString();
+  } catch {
+    return proxyUrl;
+  }
+}
 function writeMcpAddedLine(shortName, filePath) {
   process.stderr.write(
     style.green("\u2713") + ' MCP server "' + shortName + '" added to ' + style.cyan(filePath) + "\n"
@@ -1784,8 +1827,9 @@ function printHostedProxyPostWriteHints(platform, shortName) {
 }
 async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey, workspacePath) {
   const authHeader = `Bearer ${apiKey}`;
+  const proxyUrlWithKeyWhenNeeded = shouldEmbedKeyInHostedProxyUrl(platform) ? hostedProxyUrlWithKeyParam(proxyUrl, apiKey) : proxyUrl;
   if (platform === "gemini-cli") {
-    await mergeGeminiHostedMcpServersIntoSettings(shortName, proxyUrl, apiKey);
+    await mergeGeminiHostedMcpServersIntoSettings(shortName, proxyUrlWithKeyWhenNeeded, apiKey);
     process.stderr.write(
       style.dim(
         "For project-specific config, copy the mcpServers entry into .gemini/settings.json in your project root. Restart Gemini CLI if it is already running."
@@ -1810,20 +1854,24 @@ async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey,
     let result = "parse-error";
     if (platform === "cursor") {
       result = await mergeMcpServersObjectStyle(getCursorMcpJsonPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getCursorMcpJsonPath());
       }
     } else if (platform === "claude-desktop") {
-      result = await mergeClaudeDesktopHostedMcpRemote(shortName, proxyUrl, apiKey);
+      result = await mergeClaudeDesktopHostedMcpRemote(
+        shortName,
+        proxyUrlWithKeyWhenNeeded,
+        apiKey
+      );
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getClaudeDesktopConfigPath());
       }
     } else if (platform === "windsurf") {
       result = await mergeMcpServersObjectStyle(getWindsurfMcpConfigPath(), shortName, {
-        serverUrl: proxyUrl,
+        serverUrl: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
@@ -1831,25 +1879,30 @@ async function applyHostedProxyMcpConfig(platform, proxyUrl, shortName, apiKey,
       }
     } else if (platform === "cline") {
       result = await mergeMcpServersObjectStyle(getClineMcpSettingsPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getClineMcpSettingsPath());
       }
     } else if (platform === "kilo-code") {
-      result = await mergeKiloCodeProjectMcp(workspacePath, shortName, proxyUrl, apiKey);
+      result = await mergeKiloCodeProjectMcp(
+        workspacePath,
+        shortName,
+        proxyUrlWithKeyWhenNeeded,
+        apiKey
+      );
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(join(workspacePath, ".kilocode", "mcp.json"));
       }
     } else if (platform === "continue-dev") {
-      result = await mergeContinueHostedMcp(shortName, proxyUrl, apiKey);
+      result = await mergeContinueHostedMcp(shortName, proxyUrlWithKeyWhenNeeded, apiKey);
       if (result === "parse-error") {
         printHostedProxyJsonParseWarning(getContinueConfigJsonPath());
       }
     } else {
       result = await mergeMcpServersObjectStyle(getCursorMcpJsonPath(), shortName, {
-        url: proxyUrl,
+        url: proxyUrlWithKeyWhenNeeded,
         headers: { Authorization: authHeader }
       });
       if (result === "parse-error") {
@@ -1894,6 +1947,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
   ]);
   const usesInlineKey = hostedInlinePlatforms.has(platform);
   const authHeader = usesInlineKey ? `Bearer ${apiKey}` : "Bearer YOUR_SHIELD_API_KEY";
+  const urlInSnippet = usesInlineKey && shouldEmbedKeyInHostedProxyUrl(platform) ? hostedProxyUrlWithKeyParam(routingToken, apiKey) : routingToken;
   let snippetText;
   if (platform === "github-copilot") {
     snippetText = JSON.stringify(
@@ -1902,7 +1956,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
           servers: {
             [shortName]: {
               type: "http",
-              url: routingToken,
+              url: urlInSnippet,
               headers: {
                 Authorization: authHeader
               }
@@ -1914,13 +1968,13 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       2
     );
   } else if (platform === "goose") {
-    snippetText = gooseHostedProxyYaml(shortName, routingToken, authHeader);
+    snippetText = gooseHostedProxyYaml(shortName, urlInSnippet, authHeader);
   } else if (platform === "gemini-cli") {
     snippetText = JSON.stringify(
       {
         mcpServers: {
           [shortName]: {
-            httpUrl: routingToken,
+            httpUrl: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1936,7 +1990,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
         mcpServers: {
           [shortName]: {
             command: "npx",
-            args: ["-y", "mcp-remote", routingToken, "--header", `Authorization: ${authHeader}`]
+            args: ["-y", "mcp-remote", urlInSnippet, "--header", `Authorization: ${authHeader}`]
           }
         }
       },
@@ -1950,7 +2004,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
           {
             name: shortName,
             type: "streamable-http",
-            url: routingToken,
+            url: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -1966,7 +2020,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
       {
         mcpServers: {
           [shortName]: {
-            [urlKey]: routingToken,
+            [urlKey]: urlInSnippet,
             headers: {
               Authorization: authHeader
             }
@@ -2498,7 +2552,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2589,7 +2645,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2674,7 +2732,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
         if (created && proxyUrl.length > 0) {
           process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-          process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+          process.stderr.write(
+            "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+          );
           await applyHostedProxyMcpConfig(
             selectedPlatform,
             proxyUrl,
@@ -2722,7 +2782,9 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
       }
       if (created && proxyUrl.length > 0) {
         process.stderr.write("\n" + style.bold("Your Shield proxy URL:") + "\n");
-        process.stderr.write("  " + style.cyan(proxyUrl) + "\n");
+        process.stderr.write(
+          "  " + style.cyan(formatHostedProxyUrlForStderr(selectedPlatform, proxyUrl, apiKey)) + "\n"
+        );
         await applyHostedProxyMcpConfig(
           selectedPlatform,
           proxyUrl,

package/dist/shield-extension.js

@@ -22417,7 +22417,7 @@ async function writeExtensionBackup(claudeDesktopConfigPath, mcpServers) {
 
 // package.json
 var package_default = {
-  version: "1.3.5"};
+  version: "1.3.6"};
 
 // src/package-meta.ts
 var PACKAGE_VERSION = package_default.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "multicorn-shield",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "The control layer for AI agents: permissions, consent, spending limits, and audit logging.",
   "license": "MIT",
   "author": "Multicorn AI Pty Ltd",