[as992949791]

Summary

Preserve all values in repeated request configuration headers and feature query parameters. Boolean modes enable when any field line is truthy, so a later readonly or lockdown restriction takes effect.

Why

Reading only the first field line discarded later tool selections, exclusions, feature flags, and boolean restrictions. For example, readonly fields [false, true] previously left readonly disabled, and ?features=a&features=b selected only a.

Fixes #3624.

What changed

• Join all values for the four list-valued headers before the existing comma-separated parser.
• Evaluate all readonly, lockdown, and insiders field lines with the existing boolean parser. Scalar parsing is unchanged.
• Combine repeated feature query parameters, preserving features-header precedence, including an explicitly empty header.
• Cover repeated lists, boolean field ordering and false/truthy spellings, and query/header feature precedence with middleware regressions.

MCP impact

• No tool or API changes. Request configuration honors all supplied field lines; tool schemas and handlers are unchanged.
• Tool schema or behavior changed
• New tool added

Prompts tested (tool changes only)

Not applicable. Tests exercise HTTP middleware without calling live APIs or tools.

Security / limits

• Auth / permissions considered. Later readonly and lockdown restrictions now take effect. All excluded-tool names reach the existing filter; authentication is unchanged.
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR
• I am not renaming tools as part of this PR. No aliases are needed.

Lint & tests

• Linted locally with bash ./script/lint — 0 issues (golangci-lint 2.14.0, Go 1.27.3).
• Tested locally with bash ./script/test — full go test -race ./... passed after lint.
• go test -race -count=1 ./pkg/http/middleware -v and git diff --check passed.

Evidence

• Before: regression tests on the previous PR head fail for false-then-truthy boolean fields and repeated feature query parameters; later values are lost.
• After: the middleware race tests, native lint, and full repository race suite pass. Existing repeated-list and header-precedence tests pass as well.

Docs

• Not needed. This corrects parsing of existing request configuration.
• Updated (README / docs / examples)

Merge Danger

Door: two-way. Blast Radius: request configuration.

Prepared with AI assistance (Codex). All listed checks were executed locally.

[notlakshitha]

the list headers look good, and the new test passes. but the boolean headers right next to them still use r.Header.Get, which only reads the first field line: readonly at request_config.go:24, lockdown at :39 and insiders at :49. this case matters more than the list headers because it fails open. if a client sends X-MCP-Readonly: false and a proxy adds X-MCP-Readonly: true, the server ends up not read-only:

X-MCP-Readonly: [false,true] -> readonly=false
X-MCP-Lockdown: [false,true] -> lockdown=false

(that's from a quick test on this branch.) for readonly/lockdown I'd treat it as enabled if any field line is truthy, e.g. slices.ContainsFunc(r.Header.Values(h), relaxedParseBool), and add those to the repeated-header test.

small one too: the query fallback at :59 still uses query.Get("features"), so ?features=a&features=b gives [a]. if repeated headers get merged now, joining query["features"] would make the two paths behave the same.

[Copilot]

🟢 Approval recommended

The review found no active issues, and the added middleware regression coverage addresses repeated header/query values and feature-precedence behavior.

No open issues 🎉

What changed in this PR

This pull request updates HTTP request-configuration parsing so repeated field lines retain all configured list and boolean values, matching equivalent comma-separated input. It also adds regression coverage for repeated headers, query parameters, and feature precedence.

Changes:

• Combine repeated list-valued request headers before parsing.
• Preserve repeated query values and evaluate repeated boolean configuration headers consistently.
• Add table-driven middleware tests for repeated values and header/query precedence.

File	Summary
pkg/​http/​middleware/​request_config.go	Preserves repeated request-configuration header and query values during middleware parsing.
pkg/​http/​middleware/​request_config_test.go	Adds regression coverage for repeated list, boolean, query, and feature-precedence behavior.

_{Review effort: Lite (auto)}

[as992949791]

Addressed in 4b907e3. Readonly, lockdown, and insiders now check every field line with the existing relaxed boolean parser and enable if any is truthy. Repeated feature query parameters are combined; a present features header still takes precedence, including an empty header.

The added regressions fail on the previous PR head and pass with the fix. Middleware race tests, native lint (bash ./script/lint, 0 issues), and the full race suite (bash ./script/test) passed. Scalar boolean parsing is unchanged.