@@ -89,6 +89,17 @@ function transform(
       })
       // altimate_change end
     }
+    // altimate_change start — preserve bearer-auth fields, mirroring config.ts
+    // `normalizeMcpConfig`. Without these passes a discovered server's
+    // `headersCommand` / `oauth` would be dropped before reaching the runtime,
+    // silently connecting with no auth (and the loss could be persisted back to
+    // disk via mcp-discover). Copied as-is — argv values are executed via
+    // execFile at connect time, so no env-var resolution applies here, and
+    // malformed shapes are rejected downstream by the McpRemote schema with an
+    // actionable error. See #791 / #792.
+    if (entry.headersCommand && typeof entry.headersCommand === "object") result.headersCommand = entry.headersCommand
+    if (entry.oauth !== undefined) result.oauth = entry.oauth
+    // altimate_change end
     if (typeof entry.timeout === "number") result.timeout = entry.timeout
     if (typeof entry.enabled === "boolean") result.enabled = entry.enabled
     return result as Config.Mcp
 
@@ -209,6 +209,7 @@ export namespace MCP {
     resolveHeadersCommand: (spec: Record<string, string[]> | undefined, key = "test") =>
       resolveHeadersCommand(spec, key),
     hasAuthorizationHeader,
+    mergeHeaders,
   }
   // altimate_change end
 
@@ -242,10 +243,14 @@ export namespace MCP {
         // command (ENOENT, timeout, non-zero exit) rather than a bare error.
         // On a non-zero exit the actionable reason lives on `err.stderr` (e.g.
         // `az`'s "run 'az login'"), which `err.message` omits — append it.
+        // The composed message is masked before it escapes: execFile's message
+        // echoes the full argv and an auth CLI run with --verbose can print the
+        // token to stderr, and this string reaches logs and the status API.
+        // Over-masking (quoted spans become `?`) is the correct failure mode.
         const e = err as { message?: string; stderr?: string }
         const stderr = typeof e.stderr === "string" ? e.stderr.trim().slice(0, 500) : ""
         const base = err instanceof Error ? err.message : String(err)
-        const message = stderr ? `${base}: ${stderr}` : base
+        const message = Telemetry.maskString(stderr ? `${base}: ${stderr}` : base)
         throw new Error(`headersCommand[${name}] failed: ${message}`)
       }
       const value = stdout.trim()
@@ -258,9 +263,30 @@ export namespace MCP {
     return out
   }
 
-  function hasAuthorizationHeader(headers: Record<string, string>): boolean {
+  // Accepts any header-shaped record (static `headers` values are strings,
+  // `headersCommand` values are argv arrays) — only key names are inspected.
+  function hasAuthorizationHeader(headers: Record<string, unknown>): boolean {
     return Object.keys(headers).some((k) => k.toLowerCase() === "authorization")
   }
+
+  // HTTP header names are case-insensitive, so a dynamic header must replace a
+  // static one that differs only in casing (`headers.Authorization` +
+  // `headersCommand.authorization` would otherwise both be sent — duplicate
+  // credentials some servers reject). Dynamic values win under the documented
+  // contract: "Values from headersCommand override matching keys in `headers`."
+  function mergeHeaders(
+    staticHeaders: Record<string, string>,
+    dynamicHeaders: Record<string, string>,
+  ): Record<string, string> {
+    const merged: Record<string, string> = { ...staticHeaders }
+    for (const [name, value] of Object.entries(dynamicHeaders)) {
+      for (const existing of Object.keys(merged)) {
+        if (existing.toLowerCase() === name.toLowerCase()) delete merged[existing]
+      }
+      merged[name] = value
+    }
+    return merged
+  }
   // altimate_change end
 
   // Register notification handlers for MCP client
@@ -522,7 +548,7 @@ export namespace MCP {
           status: { status: "failed" as const, error: message },
         }
       }
-      const mergedHeaders: Record<string, string> = { ...(mcp.headers ?? {}), ...dynamicHeaders }
+      const mergedHeaders: Record<string, string> = mergeHeaders(mcp.headers ?? {}, dynamicHeaders)
       // altimate_change end
 
       // altimate_change start — OAuth is enabled by default for remote servers,
@@ -1348,7 +1374,19 @@ export namespace MCP {
     const mcpConfig = cfg.mcp?.[mcpName]
     if (!mcpConfig) return false
     if (!isMcpConfigured(mcpConfig)) return false
-    return mcpConfig.type === "remote" && mcpConfig.oauth !== false
+    if (mcpConfig.type !== "remote") return false
+    if (mcpConfig.oauth === false) return false
+    if (typeof mcpConfig.oauth === "object") return true
+    // altimate_change start — mirror `create()`'s auto-disable: when the user
+    // provided an Authorization header (statically or via `headersCommand`) and
+    // didn't explicitly configure OAuth, connect-time skips OAuth — so the auth
+    // API surface must not advertise it, or `POST /:name/auth` would start an
+    // OAuth flow whose tokens the connection never uses. `headersCommand` is
+    // not resolved here (that would execute the command); the presence of an
+    // Authorization key in its spec is enough to know connect-time disables
+    // OAuth. See #792.
+    return !hasAuthorizationHeader({ ...(mcpConfig.headers ?? {}), ...(mcpConfig.headersCommand ?? {}) })
+    // altimate_change end
   }
 
   /**
 
@@ -191,6 +191,44 @@ describe("discoverExternalMcp", () => {
     })
   })
 
+  // altimate_change start — discovery must preserve bearer-auth fields
+  // (headersCommand / oauth) the same way config.ts `normalizeMcpConfig` does,
+  // or auto-discovered servers silently connect with no auth. See #791 / #792.
+  test("remote: headersCommand and oauth are preserved", async () => {
+    await writeFile(
+      path.join(tempDir, ".mcp.json"),
+      JSON.stringify({
+        mcpServers: {
+          fabric: {
+            url: "https://api.fabric.microsoft.com/v1/mcp/core",
+            headersCommand: {
+              Authorization: ["az", "account", "get-access-token"],
+            },
+          },
+          "no-oauth": {
+            url: "https://example.com/mcp",
+            headers: { Authorization: "Bearer token" },
+            oauth: false,
+          },
+        },
+      }),
+    )
+
+    const { servers: result } = await discoverExternalMcp(tempDir)
+    expect(result["fabric"]).toMatchObject({
+      type: "remote",
+      url: "https://api.fabric.microsoft.com/v1/mcp/core",
+      headersCommand: { Authorization: ["az", "account", "get-access-token"] },
+    })
+    expect(result["no-oauth"]).toMatchObject({
+      type: "remote",
+      url: "https://example.com/mcp",
+      headers: { Authorization: "Bearer token" },
+      oauth: false,
+    })
+  })
+  // altimate_change end
+
   test("env → environment rename", async () => {
     await writeFile(
       path.join(tempDir, ".mcp.json"),
 
@@ -178,6 +178,101 @@ test("OAuth still attaches when Authorization header is present but oauth is exp
     },
   })
 })
+test("headersCommand overrides a static header that differs only in casing", async () => {
+  await using tmp = await tmpdir()
+  await Instance.provide({
+    directory: tmp.path,
+    fn: async () => {
+      transportCalls.length = 0
+      await MCP.add("case-merge-server", {
+        type: "remote",
+        url: "https://example.com/mcp",
+        headers: { authorization: "Bearer stale-static", "X-Other": "keep" },
+        headersCommand: {
+          Authorization: ["printf", "Bearer fresh-dynamic"],
+        },
+      }).catch(() => {})
+
+      expect(transportCalls.length).toBeGreaterThanOrEqual(1)
+      for (const call of transportCalls) {
+        // HTTP header names are case-insensitive: only the dynamic value may
+        // survive, or two Authorization headers would be sent on the wire.
+        expect(call.options.requestInit?.headers).toEqual({
+          Authorization: "Bearer fresh-dynamic",
+          "X-Other": "keep",
+        })
+        expect(call.options.authProvider).toBeUndefined()
+      }
+    },
+  })
+})
+
+test("mergeHeaders: dynamic value wins over static key differing only in casing", () => {
+  expect(
+    MCP._testing.mergeHeaders({ authorization: "Bearer stale", "X-Other": "keep" }, { Authorization: "Bearer fresh" }),
+  ).toEqual({
+    Authorization: "Bearer fresh",
+    "X-Other": "keep",
+  })
+})
+
+// Covers the auth API surface: `supportsOAuth()` must agree with `create()`'s
+// auto-disable, or `POST /:name/auth` would start an OAuth flow whose tokens
+// the bearer connection never uses.
+test("supportsOAuth mirrors the OAuth auto-disable for bearer-auth servers", async () => {
+  await using tmp = await tmpdir({
+    init: async (dir) => {
+      await Bun.write(
+        `${dir}/opencode.json`,
+        JSON.stringify({
+          $schema: "https://altimate.ai/config.json",
+          mcp: {
+            "bearer-static": {
+              type: "remote",
+              url: "https://example.com/mcp",
+              headers: { Authorization: "Bearer static-token" },
+            },
+            "bearer-cmd": {
+              type: "remote",
+              url: "https://example.com/mcp",
+              headersCommand: { authorization: ["printf", "Bearer dynamic-token"] },
+            },
+            "explicit-oauth": {
+              type: "remote",
+              url: "https://example.com/mcp",
+              headers: { Authorization: "Bearer fallback" },
+              oauth: { clientId: "client-xyz" },
+            },
+            "plain-remote": {
+              type: "remote",
+              url: "https://example.com/mcp",
+            },
+            "oauth-off": {
+              type: "remote",
+              url: "https://example.com/mcp",
+              oauth: false,
+            },
+          },
+        }),
+      )
+    },
+  })
+
+  await Instance.provide({
+    directory: tmp.path,
+    fn: async () => {
+      // Bearer present (statically or via headersCommand), oauth unspecified —
+      // connect-time auto-disables OAuth, so the API must not advertise it.
+      expect(await MCP.supportsOAuth("bearer-static")).toBe(false)
+      expect(await MCP.supportsOAuth("bearer-cmd")).toBe(false)
+      // Explicit opt-in wins even with a bearer header present.
+      expect(await MCP.supportsOAuth("explicit-oauth")).toBe(true)
+      // Defaults unchanged.
+      expect(await MCP.supportsOAuth("plain-remote")).toBe(true)
+      expect(await MCP.supportsOAuth("oauth-off")).toBe(false)
+    },
+  })
+})
 // altimate_change end
 
 test("headers are passed to transports when oauth is explicitly disabled", async () => {
 
@@ -242,6 +242,26 @@ describe("resolveHeadersCommand helper", () => {
     })
     expect(result.X).toBe("$(whoami); rm -rf /")
   })
+
+  test("masks bearer tokens leaked to stderr in the failure message", async () => {
+    // An auth CLI run with --verbose/--debug can print the token to stderr,
+    // and the failure message reaches logs and the status API. The composed
+    // message must redact token-shaped values (via Telemetry.maskString).
+    const { MCP } = await import("../../src/mcp")
+    const token = "sTLeakedTokenValue0123456789abcdef"
+    let message = ""
+    try {
+      await MCP._testing.resolveHeadersCommand({
+        Authorization: ["sh", "-c", `echo DEBUG: authorization: Bearer ${token} >&2; exit 1`],
+      })
+      throw new Error("expected resolveHeadersCommand to reject")
+    } catch (err) {
+      message = err instanceof Error ? err.message : String(err)
+    }
+    expect(message).toMatch(/headersCommand\[Authorization\] failed:/)
+    expect(message).toContain("Bearer ***")
+    expect(message).not.toContain(token)
+  })
 })
 
 // ---------------------------------------------------------------------------