feat: support ${VAR} environment variable interpolation in headers

[mrmodolo]

Problem

Header values like X-Target-Headers and X-Target-URL require hardcoded secrets and environment-specific URLs, making it difficult to version-control MCP client configurations.

Solution

Expand ${VAR_NAME} references in header values using os.environ at request time. Applied to the three headers that typically contain secrets or environment-specific values:

• X-Target-URL
• X-Target-Headers
• X-Base-URL

Example

{
  "headers": {
    "X-Target-URL": "${MY_API_ENDPOINT}",
    "X-Target-Headers": "{\"Authorization\": \"Bearer ${MY_API_TOKEN}\"}",
    "X-Base-URL": "${MY_API_BASE_URL}"
  }
}

Design decisions

• Unknown variables left as-is — ${UNDEFINED} stays literal rather than becoming empty string, making misconfiguration easy to spot.
• Scoped to 3 headers — only headers that carry secrets/URLs are expanded. X-API-Type, X-Allow-Unsafe-Paths, etc. are not interpolated.
• Single function, single regex — minimal surface area, ~8 lines of new code.
• All 336 existing tests pass with no modifications.

Security note

The expansion runs server-side, so in a shared/multi-tenant deployment a client could potentially read arbitrary env vars. This matches the existing trust model (the user who configures headers already controls the server environment), but is worth noting for anyone considering multi-tenant setups.