Skip to content

MCP client does not send dynamic Bearer token when tools selection is not set to "all" #23421

Description

@redosk

Bug Description

When connecting to an MCP server that uses Bearer authentication to dynamically filter the data it can access depending on the user communicating with my agent, the auth token is not sent when using a tool selection instead of all.

I've defined a Bearer credential with the following expression:
{{ $('B_01 - Trigger: Phase A Output').item.json.session.metadata.userToken ?? 'PERM_TOKEN_WITH_NO_DATA_ACCESS_RIGHTS' }}

The fallback permanent token defined in this expression is used when the node has no userToken, so n8n can communicate with the MCP server to list its tools before the trigger node is populated.

When the tool selection is set to all, everything works correctly. However, when I try to select specific tools, it does not work.

I also tried creating a second Bearer credential using only the permanent token. I use this credential to make the tool selection and then switch back to the dynamic credential. However, when the agent later tries to use the MCP server, it still does not work: no Authorization header is sent to the MCP server.

To Reproduce

  1. Create a workflow with an AI Agent that has an MCP Client configured as a tool.

  2. Configure the MCP Client to use a new Bearer credential.

  3. Set the credential value to an expression that references a value produced by a previous node, with a fallback value, for example :
    {{ $('Trigger Node').item.json.session.metadata.userToken ?? 'PERM_TOKEN_WITH_NO_DATA_ACCESS_RIGHTS' }}

  4. Try to list the available tools.

Expected behavior

The client should send the Authorization: Bearer PERM_TOKEN_WITH_NO_DATA_ACCESS_RIGHTS header to the MCP server when attempting to list the available tools.

Debug Info

Debug info

core

  • n8nVersion: 2.0.3
  • platform: docker (self-hosted)
  • nodeJsVersion: 22.21.0
  • nodeEnv: production
  • database: sqlite
  • executionMode: regular
  • concurrency: -1
  • license: enterprise (production)
  • consumerId: de537fb0-6c0e-436e-81f2-1100fc03e62b

storage

  • success: all
  • error: all
  • progress: false
  • manual: true
  • binaryMode: filesystem

pruning

  • enabled: true
  • maxAge: 336 hours
  • maxCount: 10000 executions

client

  • userAgent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/143.0.0.0 safari/537.36
  • isTouchDevice: false

Generated at: 2025-12-18T16:18:06.969Z

Operating System

Ubuntu 24.04.3 LTS

n8n Version

2.0.3

Node.js Version

22.21.0

Database

SQLite (default)

Execution mode

main (default)

Hosting

self hosted

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions