diff --git a/litellm/proxy/_experimental/mcp_server/server.py b/litellm/proxy/_experimental/mcp_server/server.py
index 25890d29368..7e19c44052d 100644
--- a/litellm/proxy/_experimental/mcp_server/server.py
+++ b/litellm/proxy/_experimental/mcp_server/server.py
@@ -1449,25 +1449,25 @@ if MCP_AVAILABLE:
         header for this server. This is the multi-server binding: it names one
         upstream, so it is unambiguously the caller's upstream token regardless of
         auth mode (never the LiteLLM admission credential).
+
+        Resolves through the same ``lookup_mcp_server_auth_in_headers`` egress uses, so
+        the connect gate and egress agree on which per-server header names match: a
+        dashboard client sends ``x-mcp-{sanitize_mcp_alias_for_header(alias)}-authorization``,
+        and matching only the raw alias here would 401 a token egress would forward.
         """
         if not mcp_server_auth_headers:
             return False
-        for key in (server.alias, server.server_name, server.name):
-            if not key:
-                continue
-            server_headers = None
-            for k, v in mcp_server_auth_headers.items():
-                if k.lower() == key.lower():
-                    server_headers = v
-                    break
-            if server_headers is None:
-                continue
-            if isinstance(server_headers, str) and server_headers.strip():
-                return True
-            if isinstance(server_headers, dict):
-                for hk in server_headers.keys():
-                    if hk.lower() == "authorization":
-                        return True
+        from litellm.proxy._experimental.mcp_server.utils import (
+            lookup_mcp_server_auth_in_headers,
+        )
+
+        server_headers = lookup_mcp_server_auth_in_headers(
+            mcp_server_auth_headers, alias=server.alias, server_name=server.server_name
+        )
+        if isinstance(server_headers, str):
+            return bool(server_headers.strip())
+        if isinstance(server_headers, dict):
+            return any(isinstance(hk, str) and hk.lower() == "authorization" for hk in server_headers)
         return False
 
     def _client_has_passthrough_authorization(
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_stale_session.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_stale_session.py
index 04856b33f2a..da183e8d02a 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_stale_session.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_stale_session.py
@@ -1293,6 +1293,25 @@ async def test_handle_streamable_http_mcp_per_server_header_skips_preemptive_cha
     assert challenged is False
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("auth_type", [MCPAuth.oauth_delegate, MCPAuth.true_passthrough])
+async def test_handle_streamable_http_mcp_sanitized_per_server_header_skips_preemptive_challenge(auth_type):
+    """A dashboard client sends x-mcp-{sanitize_mcp_alias_for_header(alias)}-authorization, so the
+    alias 'pt-server' arrives as the header key 'pt_server'. Egress resolves that via the sanitized
+    alias, so the connect gate must too, or it 401s a token egress would forward."""
+    try:
+        from litellm.proxy._experimental.mcp_server.server import handle_streamable_http_mcp  # noqa: F401
+    except ImportError:
+        pytest.skip("MCP server not available")
+
+    challenged, _ = await _run_passthrough_connect(
+        auth_type=auth_type,
+        server_names=["pt-server"],
+        mcp_server_auth_headers={"pt_server": {"Authorization": "Bearer upstream-token"}},
+    )
+    assert challenged is False
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize("auth_type", [MCPAuth.oauth_delegate, MCPAuth.true_passthrough])
 async def test_handle_streamable_http_mcp_aggregate_does_not_preemptively_challenge(auth_type):