Support authenticated remote MCP servers with custom request headers

[mynameistito]

Summary

Executor currently prevents adding a remote MCP server when its URL requires authentication (on ~/integrations/add/mcp).

For example, adding:

https://domain.tld/mcp

fails with:

Couldn't reach this URL. Check the address, your network, and that the server is running.

The endpoint is reachable, but protected by Cloudflare Access and requires a Cloudflare Access Service Token. Executor needs a way to provide authentication headers when adding a remote MCP integration.

Expected behaviour

Remote MCP integrations should support custom HTTP headers, including secret-backed values, so authenticated MCP endpoints can be discovered and added.

For Cloudflare Access Service Tokens, this would allow configuring:

CF-Access-Client-Id: <service-token-client-id>
CF-Access-Client-Secret: <service-token-client-secret>

The connection check and MCP discovery request should include these headers.

Suggested UX

On the Remote MCP integration form, add an optional Authentication / Request headers section where users can:

• Add one or more request headers.
• Store sensitive header values as Executor Secrets rather than plaintext.
• Reference a secret in the header value.
• Test the connection using the configured headers before saving.

For example:

Header	Value
CF-Access-Client-Id	Secret reference
CF-Access-Client-Secret	Secret reference

Security considerations

• Never expose secret values after they are saved.
• Redact sensitive headers and values from logs, UI errors, and network diagnostics.
• Use the headers both for the initial reachability check and subsequent MCP requests.
• Avoid treating an HTTP 401 or 403 as an unreachable server when authentication headers have not yet been configured.

Actual behaviour

The form reports that the URL cannot be reached and does not offer a way to add the endpoint with the required Cloudflare Access credentials.

Suggested Layout