[scan] omit UNSIGNED agent token from MCP server headers (H1)

roboco/mcp/utils.py

@@ -44,7 +44,7 @@ def _get_agent_headers(agent_id: str) -> dict[str, str]:
     if team:
         headers["X-Agent-Team"] = team
     token = os.environ.get("ROBOCO_AGENT_TOKEN")
-    if token:
+    if token and token != "UNSIGNED":
         headers["X-Agent-Token"] = token
     return headers
 

tests/unit/mcp_servers/test_mcp_utils_headers.py

@@ -0,0 +1,20 @@
+"""Tests for roboco.mcp.utils._get_agent_headers UNSIGNED-token guard."""
+
+from __future__ import annotations
+
+
+def test_get_agent_headers_omits_unsigned_token(monkeypatch):
+    from roboco.mcp import utils as mcp_utils
+
+    monkeypatch.setenv("ROBOCO_AGENT_TOKEN", "UNSIGNED")
+    h = mcp_utils._get_agent_headers("be-dev-1")
+    assert "X-Agent-Token" not in h
+    assert h["X-Agent-ID"] == "be-dev-1"
+
+
+def test_get_agent_headers_sends_real_token(monkeypatch):
+    from roboco.mcp import utils as mcp_utils
+
+    monkeypatch.setenv("ROBOCO_AGENT_TOKEN", "signed-token-abc")
+    h = mcp_utils._get_agent_headers("be-dev-1")
+    assert h["X-Agent-Token"] == "signed-token-abc"