feat: Add environment variable support for HTTP MCP headers

[pahud]

Closes: #3076

Summary

Enables ${env:VAR_NAME} syntax in HTTP MCP server headers, extending the existing environment variable processing from stdio transport to http transport. This improves security by allowing users to avoid hardcoding sensitive tokens in configuration files.

Problem

Previously, MCP configuration only supported environment variable substitution for stdio transport servers (via the env field), but not for http transport servers. Users had to hardcode sensitive tokens like GitHub PATs directly in the headers field of their MCP configuration:

{
  "mcpServers": {
    "github-http": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/",
      "headers": {
        "Authorization": "Bearer github_pat_hardcoded_token_here"
      }
    }
  }
}

This creates security risks as tokens are stored in plain text configuration files.

Solution

This PR extends the existing substitute_env_vars() function to process HTTP headers, enabling the same ${env:VAR_NAME} syntax that's already available for stdio transport.

Usage Example

Configuration:

{
  "mcpServers": {
    "github-http": {
      "type": "http", 
      "url": "https://api.githubcopilot.com/mcp/",
      "headers": {
        "Authorization": "Bearer ${env:GITHUB_TOKEN}",
        "X-API-Key": "${env:API_KEY}"
      }
    }
  }
}

Environment:

export GITHUB_TOKEN=github_pat_your_token_here
export API_KEY=your_api_key_here

Changes

Core Implementation

• crates/chat-cli/src/mcp_client/client.rs: Added environment variable processing for HTTP headers in the TransportType::Http branch

Testing

• Added comprehensive unit test test_http_headers_env_var_processing()
• Leverages existing well-tested substitute_env_vars() and process_env_vars() functions
• All tests pass: 3/3 ✅

Benefits

• 🔒 Security: Eliminates hardcoded tokens in configuration files
• 🔄 Consistency: Uses the same ${env:VAR_NAME} syntax as stdio transport
• 🎯 Focused: Minimal, clean implementation reusing existing code
• ⚡ Zero Breaking Changes: Backward compatible with existing configurations

Testing

cargo test mcp_client::client::tests
# running 3 tests
# test mcp_client::client::tests::test_substitute_env_vars ... ok
# test mcp_client::client::tests::test_http_headers_env_var_processing ... ok  
# test mcp_client::client::tests::test_process_env_vars ... ok

Related

This addresses the security concern of storing sensitive tokens in MCP configuration files and provides feature parity between stdio and http transport types for environment variable support.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[kenangell]

Looks good!