gym-cmd 3753970cc9 security: prevent forwarding litellm api keys to upstream mcp servers ... - Strip Authorization header from extra_headers for pass-through servers - Pass-through servers (auth_type=None with extra_headers: [Authorization]) must not receive the user's LiteLLM API key - Only OAuth2 M2M and pass-through servers skip Authorization header - Other headers (x-request-id, x-trace-id) are still forwarded normally - Fixes credential leakage / authentication bypass in MCP pass-through mode		2026-05-16 19:23:03 +01:00
..
mcp_server	security: prevent forwarding litellm api keys to upstream mcp servers	2026-05-16 19:23:03 +01:00