diff --git a/roboco/mcp/utils.py b/roboco/mcp/utils.py
index c006490c..235da6de 100644
--- a/roboco/mcp/utils.py
+++ b/roboco/mcp/utils.py
@@ -44,7 +44,7 @@ def _get_agent_headers(agent_id: str) -> dict[str, str]:
     if team:
         headers["X-Agent-Team"] = team
     token = os.environ.get("ROBOCO_AGENT_TOKEN")
-    if token:
+    if token and token != "UNSIGNED":
         headers["X-Agent-Token"] = token
     return headers
 
diff --git a/tests/unit/mcp_servers/test_mcp_utils_headers.py b/tests/unit/mcp_servers/test_mcp_utils_headers.py
new file mode 100644
index 00000000..a428e96a
--- /dev/null
+++ b/tests/unit/mcp_servers/test_mcp_utils_headers.py
@@ -0,0 +1,20 @@
+"""Tests for roboco.mcp.utils._get_agent_headers UNSIGNED-token guard."""
+
+from __future__ import annotations
+
+
+def test_get_agent_headers_omits_unsigned_token(monkeypatch):
+    from roboco.mcp import utils as mcp_utils
+
+    monkeypatch.setenv("ROBOCO_AGENT_TOKEN", "UNSIGNED")
+    h = mcp_utils._get_agent_headers("be-dev-1")
+    assert "X-Agent-Token" not in h
+    assert h["X-Agent-ID"] == "be-dev-1"
+
+
+def test_get_agent_headers_sends_real_token(monkeypatch):
+    from roboco.mcp import utils as mcp_utils
+
+    monkeypatch.setenv("ROBOCO_AGENT_TOKEN", "signed-token-abc")
+    h = mcp_utils._get_agent_headers("be-dev-1")
+    assert h["X-Agent-Token"] == "signed-token-abc"