[as992949791]

Summary

Preserve all field lines for list-valued request configuration headers. Requests with two X-MCP-Toolsets field lines now behave like the equivalent comma-separated field.

- Header.Get(name) → first field line → comma split
+ Header.Values(name) → comma join → comma split

Why

Header.Get discarded names from later X-MCP-Toolsets, X-MCP-Tools, X-MCP-Exclude-Tools, and X-MCP-Features field lines. This could hide requested tools or omit configured exclusions/features when a client or intermediary supplied more than one line.

Fixes #3624.

What changed

• Join all values of each list-valued header before the existing parser handles commas, whitespace, and empty entries.
• Add a table-driven middleware regression for all four headers, also checking that a present features header still suppresses query features.

MCP impact

• No tool or API changes. Tool schemas and handlers are unchanged; transport configuration retains values from repeated field lines.
• Tool schema or behavior changed
• New tool added

Prompts tested (tool changes only)

Not applicable. Tested the middleware through HTTP requests without calling tools or live APIs.

Security / limits

• Auth / permissions considered. Authentication is unchanged. Excluded-tool names on later field lines now reach the existing exclusion filter.
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR
• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint (golangci-lint v2.14.0 built with Go 1.27.3)
• Tested locally with ./script/test (go test -race ./...)
• go vet ./pkg/http/middleware and git diff --check passed.

Evidence

• Before: TestWithRequestConfigRepeatedListHeaders failed for toolsets, tools, excluded tools, and features: expected [first second third fourth], got [first second].
• After: the middleware package race tests and full repository race suite pass.

Docs

• Not needed. This fixes handling of existing headers.
• Updated (README / docs / examples)

Merge Danger

Door: two-way. Blast Radius: request configuration.

Prepared with AI assistance (Codex). All listed checks were executed locally.