mcp-remote `--header` with a space gives 401: move the value into an env var

Symptom

The remote server receives an empty Authorization header and answers 401; mcp-remote then falls back to OAuth and fails (Incompatible auth server: does not support dynamic client registration).

Environment and tested versions

Debian GNU/Linux 13 (trixie) x86_64, node 20.19.2, npm 11.21.1; mock server accepting only Authorization: Bearer good-token (fake test token)

• mcp-remote 0.15.2
• @modelcontextprotocol/sdk (TypeScript) 1.32.2
• node 20.19.2

Client used in the test: Tested against a local mock MCP server on 127.0.0.1, not a real provider. The client-side arg splitting was simulated by passing the split args myself; the affected clients were not run.

Root cause

Some clients (per the mcp-remote README: Cursor, Codex CLI and Claude Desktop on Windows) don't escape spaces inside args, so Authorization: Bearer <token> gets split and mcp-remote sends Authorization: with an empty value.

Fix steps

1. Keep the arg free of spaces: "--header","Authorization:${AUTH_HEADER}".
2. Put the full value, spaces included, in "env": {"AUTH_HEADER": "Bearer <token>"}.
3. Alternative: use --header-file (one Name: value per line), which also keeps the token out of the process list.
4. Restart the client.

Verification

Tested 31 Oct 2026 in a throwaway directory on a Linux box (fake credentials only). Before (A) and after the fix:

A split args (simulated bug): server log POST /mcp auth="" -> 401; FAILED: Connection closed
B README workaround:          CONNECTED tools: hello, CALL "hello from remote" (server saw auth="Bearer good-token")
C control, unsplit original:  CONNECTED (the problem is the splitting, not the header)

Sources

• https://www.npmjs.com/package/mcp-remote (Custom Headers note in the package's own README; repo https://github.com/punkpeye/mcp-remote)