From 78e828cba0b3e23ee9c032bdc8c66780b2b5cebf Mon Sep 17 00:00:00 2001
From: "Sharad." <sharadvc@users.noreply.github.com>
Date: Sat, 12 Sep 2026 14:17:37 +0000
Subject: [PATCH] Reject malformed --header values instead of silently dropping
 them

Throw when a --header argument has no colon or an empty name, so audits
cannot run unauthenticated due to a mistyped header.

Fixes AgentPostmortem/MCP-audit#24
---
 src/cli.ts       |  7 ++++++-
 test/cli.test.ts | 13 +++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/cli.ts b/src/cli.ts
index c9e8c4e..61b9110 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -120,7 +120,12 @@ export function collectHeaders(
   for (const v of values) {
     if (typeof v !== "string") continue;
     const idx = v.indexOf(":");
-    if (idx > 0) headers[v.slice(0, idx).trim()] = v.slice(idx + 1).trim();
+    if (idx <= 0) {
+      throw new Error(
+        `Invalid --header "${v}"; expected "Name: value" with a colon separator.`,
+      );
+    }
+    headers[v.slice(0, idx).trim()] = v.slice(idx + 1).trim();
   }
   return headers;
 }
diff --git a/test/cli.test.ts b/test/cli.test.ts
index 902e195..d0dba1f 100644
--- a/test/cli.test.ts
+++ b/test/cli.test.ts
@@ -58,6 +58,19 @@ describe("HTTP headers", () => {
     expect(collectHeaders(flags)).toEqual({ Authorization: "Bearer a:b" });
   });
 
+  it("rejects a header value without a colon", () => {
+    const { flags } = parseArgs([
+      "http",
+      "https://example.com/mcp",
+      "--header",
+      "Authorization",
+    ]);
+
+    expect(() => collectHeaders(flags)).toThrow(
+      /header.*colon/i,
+    );
+  });
+
   it("keeps last-wins behavior for repeated non-header flags", () => {
     const { flags } = parseArgs([
       "http",