#2407·CopilotKit

Feature Request: Support MCP servers with dynamic API keys

Author: hejtmiiCreated Sep 2, 2025Updated Sep 15, 2026
Labelsfeature request

Tell us your idea

We have a central MCP server serving multiple users

The server passes given API key (authentication token) to the underlying Management API which uses the API key to evaluate permissions

We are using a single instance of self-hosted runtime of CopilotKit with createMCPClient configured

MCP server is defined at the FE (via setMcpServers), passing the server URL + API key of the given user

Every user has their own authentication tokens that are automatically provided and refreshed by the UI code Tokens are short living (max 10 minutes) One user may have more tokens (each browser window has its own)

The problem is that CopilotKit assumes that the configuration of MCP server is static during the run of the app, having a static API key

The underlying action cache is only indexed by endpointUrl, API key not included at all

https://github.com/CopilotKit/CopilotKit/blob/20b5d99f75726238fb74ddac8d46143d21960301/CopilotKit/packages/runtime/src/lib/runtime/copilot-runtime.ts#L1451

We bypass that by appending unique query parameter to the endpointUrl ... ?uid={hash_of_api_key} so that they are cached for every API key separately. It somewhat works, BUT...

  • It causes a memory leak, keeping all no longer MCP clients in the memory - There is no way to clear the cache / it has no timeout for the entries
  • Every newly setup endpointUrl must initialize its available tools (which further extends the memory leak footprint), even though the server is the same

There should be some way to handle this situation, being able to have a single endpointUrl of a shared server instance, passing the API key from the individual request to the tool call.

It might be enough if the MCP tool call got the respective context (related MCP server config) in its second parameter. The custom MCP client could then extract it and add the API key dynamically to the request headers for that specific call.

Please add such feature, or advise how it could be done with the current code.