feat: add -jwt flag for JWT bearer auth to mcp-test-client

[Pratham-Mishra04]

Summary

Adds a -jwt flag to the MCP test client, allowing a JWT to be passed as the Authorization: Bearer credential. This provides a distinct flag for JWT-based authentication separate from the existing -bearer flag (which is intended for virtual keys), making the client's credential options more explicit and self-documenting.

Changes

• Added a -jwt CLI flag that sets Authorization: Bearer <jwt> on outbound requests
• Added a mutual exclusivity check between -bearer and -jwt, since both write to the same Authorization header — the client exits with an error if both are provided
• Updated the README and package-level doc comment to reflect JWT as a supported credential style under headers auth mode

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Run the test client with a JWT against a Bifrost MCP server configured for headers or both auth mode:

cd examples/mcps/mcp-test-client
GOWORK=off go run . -auth headers -jwt eyJhbGciOi...

Verify that passing both -bearer and -jwt together exits with an error:

GOWORK=off go run . -auth headers -bearer sk-bf-xxxxx -jwt eyJhbGciOi...
# Expected: error: -bearer and -jwt both set Authorization: Bearer and are mutually exclusive

Breaking changes

• Yes
• No

Related issues

Security considerations

The -jwt flag transmits a JWT as a bearer token over HTTP. Users should ensure the MCP server endpoint is served over TLS in any non-local environment to prevent token exposure in transit.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

🧹 Nitpick comments (1)

examples/mcps/mcp-test-client/main.go (1)

95-101: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add table-driven tests for the credential contract.

Cover these cases:

• -jwt sets Authorization: Bearer <jwt>.
• -bearer preserves the existing behavior.
• Both flags return an error before connecting.

Extract header construction and validation into a helper that returns an error. This makes the conflict path testable without testing os.Exit.

As per coding guidelines, behavior changes require deterministic, table-driven Go coverage.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@examples/mcps/mcp-test-client/main.go` around lines 95 - 101, Extract the
credential validation and Authorization header construction from the main flow
into a helper that returns an error, preserving the existing -jwt, -bearer, and
mutually exclusive behavior without calling os.Exit. Add deterministic
table-driven tests covering JWT headers, bearer headers, and conflicting flags
returning an error before any connection attempt.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@examples/mcps/mcp-test-client/main.go`:
- Around line 95-101: Extract the credential validation and Authorization header
construction from the main flow into a helper that returns an error, preserving
the existing -jwt, -bearer, and mutually exclusive behavior without calling
os.Exit. Add deterministic table-driven tests covering JWT headers, bearer
headers, and conflicting flags returning an error before any connection attempt.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d23e6c61-8a7a-43b5-b092-a5227d9e122f

📥 Commits

Reviewing files that changed from the base of the PR and between 7a8136b and 1832ada.

📒 Files selected for processing (2)

• examples/mcps/mcp-test-client/README.md
• examples/mcps/mcp-test-client/main.go

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[Pratham-Mishra04]

Merge activity

• Aug 8, 10:33 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Aug 8, 10:56 AM UTC: Graphite rebased this pull request as part of a merge.
• Aug 8, 10:57 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

The base branch was changed.