undefined on stdio.
REDACTION: credential headers (see DEFAULT_SENSITIVE_HEADERS, tuned
by FastMCPOptions.http) are withheld from headers and listed in
redactedHeaderNames, so a null lookup is never silent. The redaction
guards accidental egress: tool results and logs flow into model context by
design. A RequestVerifier receives the FULL wire headers instead (its
redactedHeaderNames is empty): the verifier is the credential-handling
code.
TRUST: every value here is client-controlled input. Nothing in this object
is authenticated. Do not derive authorization from it in handlers. For
header-established identity (trusted reverse proxy), configure
FastMCPOptions.auth with a RequestVerifier so identity flows through
ctx.auth like every other authenticated request. See docs:
servers/auth/trusted-proxy.
Properties
headers
method
redactedHeaderNames
headers.