add list of allowed headers to be passed to tool calls

[kevin-shelaga]

Add new allowedHeaders option on agent mcp server config. Its an array of string (case insensitive) of headers to be passed along to tool calls.

This is useful for things outside of jwt, like passing in tenant id and user email for cloud provider calls.

[Copilot]

Pull request overview

This PR adds support for propagating specific HTTP headers from A2A requests to MCP tool calls, allowing selective header forwarding based on a configured allowlist.

Changes:

• Added header propagation functionality to combine STS tokens with allowlisted headers from A2A requests
• Updated CRDs and Go types to support allowedHeaders configuration on Agent MCP tools
• Added new dependencies (filelock and urllib3) to support the implementation

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
python/uv.lock	Updated filelock (3.18.0 → 3.20.3) and urllib3 (2.5.0 → 2.6.3), added as new dependencies
python/packages/kagent-adk/tests/unittests/test_header_propagation.py	Comprehensive unit tests for header propagation including case-insensitivity, STS combination, and edge cases
python/packages/kagent-adk/src/kagent/adk/types.py	Core implementation of create_header_provider function and propagate_headers fields on MCP server configs
helm/kagent-crds/templates/kagent.dev_remotemcpservers.yaml	Added allowedHeaders field to RemoteMCPServer CRD schema
go/internal/controller/translator/agent/testdata/inputs/agent_with_allowed_headers.yaml	Test data demonstrating agent configuration with allowed headers
go/internal/controller/translator/agent/adk_api_translator.go	Updated translator to pass allowedHeaders from Agent spec to ADK config
go/internal/adk/types.go	Added PropagateHeaders field to HttpMcpServerConfig and SseMcpServerConfig structs
go/config/crd/bases/kagent.dev_agents.yaml	Added allowedHeaders field to McpServerTool in Agent CRD schema
go/api/v1alpha2/zz_generated.deepcopy.go	Generated deepcopy implementation for AllowedHeaders field
go/api/v1alpha2/agent_types.go	Added AllowedHeaders field to McpServerTool struct

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.