How to Add Custom Headers to Outgoing Backend Requests (Proxy Mode, HTTP)

[rishidhupar]

Hi,

We’re running FastMCP in proxy mode, both our proxy and backends use HTTP transport.
I’d like to know if there’s a recommended way to add custom headers to outgoing requests sent from the proxy to the backend servers (and not responses to clients). I see how to add middleware for responses, but haven’t found a clear way to intercept and modify backend request headers.

The specific use-case is related to authentication and passing metadata from the proxy server to backends.

Is there an official pattern or hook for this, or do we need to customize the transport layer directly?
Any code samples or pointers would be appreciated!

Thanks in advance,
Rishi

[KaliszS]

If I understand it correctly, proxy server is just a local MCP server with stdio transport which redirect to another MCP server with HTTP transport. So you would have to pass those headers somehow through stdio. I don't know if there is any possible solution to achieve that atm.

[pedro-inf-custodio]

@rishidhupar I’m running into the same issue with the exact same setup. I also tried adding a custom middleware (as mentioned in this comment: #2819), but unfortunately it didn’t resolve the problem.

[Michael-WhiteCapData]

This has a supported path in current FastMCP.

For a fixed header used on every upstream connection, configure it on the proxy's upstream client/transport:

from fastmcp import Client, FastMCP
from fastmcp.client.transports import StreamableHttpTransport

upstream = Client(
    StreamableHttpTransport(
        "https://backend.example/mcp",
        headers={"X-Proxy-Service": "orders"},
    )
)
proxy = FastMCP.as_proxy(upstream)

For per-request metadata, current proxy transports enable incoming-header forwarding. FastMCP filters hop-by-hop/transport-owned headers, and credential headers need deliberate treatment; do not blindly relay the frontend Authorization token to a different backend origin unless that backend is the intended audience.

If the backend needs a different credential, use a dedicated upstream auth=/header or a client factory that obtains the backend credential. That keeps frontend authentication and backend service authentication separate.

The static-header form is documented under HTTP transport configuration, and the current proxy implementation applies its forwarding policy in PROXY_TRANSPORT_OPTIONS.

For older 2.x releases, this behavior was not equivalent across versions, so pin the version and test one end-to-end request before depending on dynamic forwarding.