multicorn-shield 1.3.6 → 1.4.0

package/CHANGELOG.md

@@ -9,6 +9,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Bump `version` in `package.json` before publishing to npm.
 
+## [1.4.0] - 2026-05-08
+
+### Added
+
+- Hosted proxy wizard now prompts for upstream MCP server authentication (header name and value) when the target server requires credentials
+- Helpful examples shown during hosted proxy setup: common MCP server URLs (GitHub, Supabase, Atlassian, Stripe) with links to where to find tokens
+- Upstream auth headers are stored encrypted and forwarded by the proxy to the target MCP server on every request
+
+### Changed
+
+- Target MCP server URL prompt now shows common examples instead of a generic placeholder
+- "govern" replaced with "control" in all user-facing copy
+- "upstream auth" replaced with "server credentials" in all user-facing copy
+
+### Fixed
+
+- Hosted proxy connections to MCP servers requiring authentication (e.g. GitHub, Supabase) now work end-to-end - previously the proxy forwarded requests without credentials
+
 ## [1.3.6] - 2026-05-08
 
 ### Fixed

package/dist/multicorn-proxy.js

@@ -1500,8 +1500,8 @@ async function promptProxyConfig(ask, agentName) {
   while (targetUrl.length === 0) {
     process.stderr.write(
       "\n" + style.bold("Target MCP server URL:") + "\n" + style.dim(
-        "The URL of the MCP server you want Shield to protect. Example: https://your-server.example.com/mcp"
-      ) + "\n"
+        "This is the URL of the MCP server you want Shield to control. Common examples:"
+      ) + "\n" + style.dim("  GitHub:     https://api.githubcopilot.com/mcp/") + "\n" + style.dim("  Supabase:   https://mcp.supabase.com/sse") + "\n" + style.dim("  Atlassian:  https://mcp.atlassian.com/v1/sse") + "\n" + style.dim("  Stripe:     https://mcp.stripe.com/v1/sse") + "\n" + style.dim("Check your MCP server's documentation for the correct URL.") + "\n"
     );
     const input = await ask("URL: ");
     if (input.trim().length === 0) {
@@ -1521,10 +1521,44 @@ async function promptProxyConfig(ask, agentName) {
     targetUrl = input.trim();
   }
   const shortName = normalizeAgentName(agentName) || "shield-mcp";
-  return { targetUrl, shortName };
+  process.stderr.write(
+    "\n" + style.bold("Does this MCP server require authentication?") + "\n" + style.dim(
+      "Most MCP servers need a token or API key. Check the server's docs for how to get one:"
+    ) + "\n" + style.dim("  GitHub:     Settings > Developer Settings > Personal Access Tokens") + "\n" + style.dim(
+      "  Supabase:   Project Settings > API > anon or scoped key (service role bypasses RLS; avoid for most MCP)"
+    ) + "\n" + style.dim("  Atlassian:  id.atlassian.com > API Tokens") + "\n" + style.dim("  Stripe:     Dashboard > Developers > API Keys") + "\n"
+  );
+  const authReply = await ask("(y/N): ");
+  const authNorm = authReply.trim().toLowerCase();
+  const wantsAuth = authNorm === "y" || authNorm === "yes";
+  let upstreamHeaders;
+  if (wantsAuth) {
+    process.stderr.write(
+      "\n" + style.bold("Enter the Authorization header value.") + "\n" + style.dim("  For Bearer tokens: Bearer ghp_xxxxxxxxxxxx") + "\n" + style.dim("  For API keys:      Bearer sk-xxxxxxxxxxxx") + "\n"
+    );
+    const headerVal = await ask("Value: ");
+    const trimmed = headerVal.trim();
+    if (trimmed.length > 0) {
+      upstreamHeaders = { Authorization: trimmed };
+    }
+  }
+  return {
+    targetUrl,
+    shortName,
+    ...upstreamHeaders !== void 0 ? { upstreamHeaders } : {}
+  };
 }
-async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverName, platform) {
+async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverName, platform, upstreamHeaders) {
   let response;
+  const body = {
+    server_name: serverName,
+    target_url: targetUrl,
+    platform,
+    agent_name: agentName
+  };
+  if (upstreamHeaders !== void 0 && Object.keys(upstreamHeaders).length > 0) {
+    body["upstream_headers"] = upstreamHeaders;
+  }
   try {
     response = await fetch(`${baseUrl}/api/v1/proxy/config`, {
       method: "POST",
@@ -1532,12 +1566,7 @@ async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverNa
         "Content-Type": "application/json",
         "X-Multicorn-Key": apiKey
       },
-      body: JSON.stringify({
-        server_name: serverName,
-        target_url: targetUrl,
-        platform,
-        agent_name: agentName
-      }),
+      body: JSON.stringify(body),
       signal: AbortSignal.timeout(1e4)
     });
   } catch (error) {
@@ -2445,7 +2474,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
           }
         }
       } else {
-        const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+        const { targetUrl, shortName, upstreamHeaders } = await promptProxyConfig(ask, agentName);
         let proxyUrl = "";
         let created = false;
         while (!created) {
@@ -2457,7 +2486,8 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
               agentName,
               targetUrl,
               shortName,
-              selectedPlatform
+              selectedPlatform,
+              upstreamHeaders
             );
             spinner.stop(true, "Proxy config created!");
             created = true;
@@ -2538,7 +2568,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
           }
         }
       } else {
-        const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+        const { targetUrl, shortName, upstreamHeaders } = await promptProxyConfig(ask, agentName);
         let proxyUrl = "";
         let created = false;
         while (!created) {
@@ -2550,7 +2580,8 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
               agentName,
               targetUrl,
               shortName,
-              selectedPlatform
+              selectedPlatform,
+              upstreamHeaders
             );
             spinner.stop(true, "Proxy config created!");
             created = true;
@@ -2625,7 +2656,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
           }
         }
       } else {
-        const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+        const { targetUrl, shortName, upstreamHeaders } = await promptProxyConfig(ask, agentName);
         let proxyUrl = "";
         let created = false;
         while (!created) {
@@ -2637,7 +2668,8 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
               agentName,
               targetUrl,
               shortName,
-              selectedPlatform
+              selectedPlatform,
+              upstreamHeaders
             );
             spinner.stop(true, "Proxy config created!");
             created = true;
@@ -2675,7 +2707,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
       }
     } else {
-      const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+      const { targetUrl, shortName, upstreamHeaders } = await promptProxyConfig(ask, agentName);
       let proxyUrl = "";
       let created = false;
       while (!created) {
@@ -2687,7 +2719,8 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
             agentName,
             targetUrl,
             shortName,
-            selectedPlatform
+            selectedPlatform,
+            upstreamHeaders
           );
           spinner.stop(true, "Proxy config created!");
           created = true;

package/dist/multicorn-shield.js

@@ -1571,8 +1571,8 @@ async function promptProxyConfig(ask, agentName) {
   while (targetUrl.length === 0) {
     process.stderr.write(
       "\n" + style.bold("Target MCP server URL:") + "\n" + style.dim(
-        "The URL of the MCP server you want Shield to protect. Example: https://your-server.example.com/mcp"
-      ) + "\n"
+        "This is the URL of the MCP server you want Shield to control. Common examples:"
+      ) + "\n" + style.dim("  GitHub:     https://api.githubcopilot.com/mcp/") + "\n" + style.dim("  Supabase:   https://mcp.supabase.com/sse") + "\n" + style.dim("  Atlassian:  https://mcp.atlassian.com/v1/sse") + "\n" + style.dim("  Stripe:     https://mcp.stripe.com/v1/sse") + "\n" + style.dim("Check your MCP server's documentation for the correct URL.") + "\n"
     );
     const input = await ask("URL: ");
     if (input.trim().length === 0) {
@@ -1592,10 +1592,44 @@ async function promptProxyConfig(ask, agentName) {
     targetUrl = input.trim();
   }
   const shortName = normalizeAgentName(agentName) || "shield-mcp";
-  return { targetUrl, shortName };
+  process.stderr.write(
+    "\n" + style.bold("Does this MCP server require authentication?") + "\n" + style.dim(
+      "Most MCP servers need a token or API key. Check the server's docs for how to get one:"
+    ) + "\n" + style.dim("  GitHub:     Settings > Developer Settings > Personal Access Tokens") + "\n" + style.dim(
+      "  Supabase:   Project Settings > API > anon or scoped key (service role bypasses RLS; avoid for most MCP)"
+    ) + "\n" + style.dim("  Atlassian:  id.atlassian.com > API Tokens") + "\n" + style.dim("  Stripe:     Dashboard > Developers > API Keys") + "\n"
+  );
+  const authReply = await ask("(y/N): ");
+  const authNorm = authReply.trim().toLowerCase();
+  const wantsAuth = authNorm === "y" || authNorm === "yes";
+  let upstreamHeaders;
+  if (wantsAuth) {
+    process.stderr.write(
+      "\n" + style.bold("Enter the Authorization header value.") + "\n" + style.dim("  For Bearer tokens: Bearer ghp_xxxxxxxxxxxx") + "\n" + style.dim("  For API keys:      Bearer sk-xxxxxxxxxxxx") + "\n"
+    );
+    const headerVal = await ask("Value: ");
+    const trimmed = headerVal.trim();
+    if (trimmed.length > 0) {
+      upstreamHeaders = { Authorization: trimmed };
+    }
+  }
+  return {
+    targetUrl,
+    shortName,
+    ...upstreamHeaders !== void 0 ? { upstreamHeaders } : {}
+  };
 }
-async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverName, platform) {
+async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverName, platform, upstreamHeaders) {
   let response;
+  const body = {
+    server_name: serverName,
+    target_url: targetUrl,
+    platform,
+    agent_name: agentName
+  };
+  if (upstreamHeaders !== void 0 && Object.keys(upstreamHeaders).length > 0) {
+    body["upstream_headers"] = upstreamHeaders;
+  }
   try {
     response = await fetch(`${baseUrl}/api/v1/proxy/config`, {
       method: "POST",
@@ -1603,12 +1637,7 @@ async function createProxyConfig(baseUrl, apiKey, agentName, targetUrl, serverNa
         "Content-Type": "application/json",
         "X-Multicorn-Key": apiKey
       },
-      body: JSON.stringify({
-        server_name: serverName,
-        target_url: targetUrl,
-        platform,
-        agent_name: agentName
-      }),
+      body: JSON.stringify(body),
       signal: AbortSignal.timeout(1e4)
     });
   } catch (error) {
@@ -2525,7 +2554,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
           }
         }
       } else {
-        const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+        const { targetUrl, shortName, upstreamHeaders } = await promptProxyConfig(ask, agentName);
         let proxyUrl = "";
         let created = false;
         while (!created) {
@@ -2537,7 +2566,8 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
               agentName,
               targetUrl,
               shortName,
-              selectedPlatform
+              selectedPlatform,
+              upstreamHeaders
             );
             spinner.stop(true, "Proxy config created!");
             created = true;
@@ -2618,7 +2648,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
           }
         }
       } else {
-        const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+        const { targetUrl, shortName, upstreamHeaders } = await promptProxyConfig(ask, agentName);
         let proxyUrl = "";
         let created = false;
         while (!created) {
@@ -2630,7 +2660,8 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
               agentName,
               targetUrl,
               shortName,
-              selectedPlatform
+              selectedPlatform,
+              upstreamHeaders
             );
             spinner.stop(true, "Proxy config created!");
             created = true;
@@ -2705,7 +2736,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
           }
         }
       } else {
-        const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+        const { targetUrl, shortName, upstreamHeaders } = await promptProxyConfig(ask, agentName);
         let proxyUrl = "";
         let created = false;
         while (!created) {
@@ -2717,7 +2748,8 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
               agentName,
               targetUrl,
               shortName,
-              selectedPlatform
+              selectedPlatform,
+              upstreamHeaders
             );
             spinner.stop(true, "Proxy config created!");
             created = true;
@@ -2755,7 +2787,7 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
         }
       }
     } else {
-      const { targetUrl, shortName } = await promptProxyConfig(ask, agentName);
+      const { targetUrl, shortName, upstreamHeaders } = await promptProxyConfig(ask, agentName);
       let proxyUrl = "";
       let created = false;
       while (!created) {
@@ -2767,7 +2799,8 @@ You have ${String(agentsForPlatform.length)} agent(s) connected for ${selectedLa
             agentName,
             targetUrl,
             shortName,
-            selectedPlatform
+            selectedPlatform,
+            upstreamHeaders
           );
           spinner.stop(true, "Proxy config created!");
           created = true;

package/dist/shield-extension.js

@@ -22417,7 +22417,7 @@ async function writeExtensionBackup(claudeDesktopConfigPath, mcpServers) {
 
 // package.json
 var package_default = {
-  version: "1.3.6"};
+  version: "1.4.0"};
 
 // src/package-meta.ts
 var PACKAGE_VERSION = package_default.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "multicorn-shield",
-  "version": "1.3.6",
+  "version": "1.4.0",
   "description": "The control layer for AI agents: permissions, consent, spending limits, and audit logging.",
   "license": "MIT",
   "author": "Multicorn AI Pty Ltd",