Headers

pick.tools reads these request headers. It forwards none of them upstream as they are; every other header is dropped.

Header	Meaning
`X-Pick-Key-<slug>: <secret>`	The credential for service `<slug>`. Value is the raw secret; pick.tools formats it per the server's declared header (adds `Bearer` when the declared header is `Authorization` and the value does not already start with `Bearer` ).
`X-Pick-Header-<slug>-<name>: <value>`	Escape hatch for servers that declare extra headers (e.g. `x-org-id`).
`X-Pick-Client: <string>`	Optional self-chosen client label, stored as `client_id`. Unverified.
`X-Pick-Private: 1`	Exclude this call from public per-server aggregates (still counted in a global private total and rate-limited).
`Authorization`	Not used in v1; reserved for future pick.tools API keys/OAuth. Never forwarded.

Slugs

A slug matches ^[a-z0-9]+(-[a-z0-9]+)*$ and has at most 40 characters. It is the last part of a server's page URL, e.g. /servers/kagi. Header names are not case-sensitive. In X-Pick-Header-<slug>-<name>, a slug that holds a hyphen is matched to the longest slug in the catalog.

Where the key goes upstream

You always send X-Pick-Key-<slug>. Where pick.tools puts the key is a property of the server, shown on its page:

header (the default): in the header the server declares, e.g. Authorization or x-api-key. When the server's header takes a scheme such as Bearer, pick.tools adds it unless your value already starts with it.
path or query: the server's URL is a template with one {key} slot, and pick.tools puts the URL-encoded key there. Scheme and host always come from the catalog, never from the caller.

A key for one service is never sent to another. Without a required key, call_tool answers with an error that names the header to set. Upstream URLs are never logged.

Examples

Kagi takes the key in a header:

claude mcp add --transport http pick https://pick.tools/mcp --header "X-Pick-Key-kagi: <your Kagi key>"

pick.tools sends Authorization: Bearer <your Kagi key> to https://mcp.kagi.com/mcp.

Firecrawl takes the key in the URL path:

claude mcp add --transport http pick https://pick.tools/mcp --header "X-Pick-Key-firecrawl: <your Firecrawl key>"

The catalog URL is https://mcp.firecrawl.dev/{key}/v2/mcp; pick.tools calls it with your key in place of {key}.

For several services, repeat --header, one per service.