MCPServerEntry response headers get swallowed by VirtualMCPServer #6743

mcpRouter.all('/mcp', async (ctx, _) => {
  const body = ctx.request.body;
  const isToolCall =
    typeof body === 'object' && body !== null && 'method' in body && body.method === 'tools/call';
  if (isToolCall) {
    ctx.status = 403;
    ctx.set(
      'WWW-Authenticate',
      'Bearer error="insufficient_scope", error_description="mcp header experiment", scope="mcp.write"',
    );
    ctx.body = {
      error: 'insufficient_scope',
      error_description: 'mcp header experiment',
    };
    return;
  }
  // SNIP
});

HTTP/2 403
server: nginx
date: Wed, 16 Sep 2026 08:41:31 GMT
content-type: application/json; charset=utf-8
content-length: 74
vary: Accept-Encoding
www-authenticate: Bearer error="insufficient_scope", error_description="mcp header experiment", scope="mcp.write" <-- BINGO!
strict-transport-security: max-age=31622400; includeSubDomains
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS
access-control-allow-headers: accept, content-type
access-control-expose-headers: x-request-id, content-disposition

HTTP/2 403
server: nginx
date: Wed, 16 Sep 2026 08:42:24 GMT
content-type: application/json
content-length: 94
vary: Accept-Encoding
strict-transport-security: max-age=31622400; includeSubDomains
access-control-allow-credentials: true
access-control-allow-methods: OPTIONS
access-control-allow-headers: accept, content-type
access-control-expose-headers: x-request-id, content-disposition