[Bug]: PassThrough Header configuration seems to be broken through environment variables.

[terylt]

🐞 Bug Summary

When configuring pass through headers using environment variables as described here: https://ibm.github.io/mcp-context-forge/overview/passthrough/#enable-the-feature-required , the headers are not passed on to the tools.

This seems to be related to two things:

1. The global configs seems to take precedence over the environment variables as suggested by the code in get_passthrough_headers:

     # Get global passthrough headers first
    global_config = db.query(GlobalConfig).first()
    allowed_headers = global_config.passthrough_headers if global_config else            settings.default_passthrough_headers

2. There is a bug in how the DEFAULT_PASSTHROUGH_HEADERS is documented, at least on a MAC. If you assign the value using:

DEFAULT_PASSTHROUGH_HEADERS=["value1", "value2"]

The gateway won't pick it up properly (at least on a MAC)

This is works better, but the database still overrides the environment variables:

DEFAULT_PASSTHROUGH_HEADERS='["value1", "value2"]'

---

🧩 Affected Component

Select the area of the project impacted:

• mcpgateway - API
• mcpgateway - UI (admin panel)
• mcpgateway.wrapper - stdio wrapper
• Federation or Transports
• CLI, Makefiles, or shell scripts
• Container setup (Docker/Podman/Compose)
• Other (explain below)

---

🔁 Steps to Reproduce

1. Set the default headers and enable pass through through environment variables.
2. Try to access variables in a plugin, or downstream in an MCP tool
3. Headers don't get forwarded.

---

🤔 Expected Behavior

The system should respect the headers were set in the environment. Perhaps the environment variables should be merged with the config database. This should all be clearly defined in the docs. What takes precedence and how does it work?

🧠 Environment Info

You can retrieve most of this from the /version endpoint.

Key	Value
Version or commit	v0.9.0
Runtime	Python 3.13, Gunicorn
Platform / OS	macOS
Container	none

---