diff --git a/opax-mcp/server.py b/opax-mcp/server.py
index 33356b3..3a65dd5 100644
--- a/opax-mcp/server.py
+++ b/opax-mcp/server.py
@@ -116,7 +116,7 @@ def _osvauco_agent_identity_token() -> str:
         raise
 
 def _osvauco_agent_headers() -> dict:
-    return {"Authorization": f"Bearer {_osvauco_agent_identity_token()}", "Content-Type": "application/json"}
+    return {"Authorization": f"Bearer {_osvauco_agent_identity_token()}", "X-MCP-Secret": os.environ.get("MCP_SECRET", ""), "Content-Type": "application/json"}
 
 async def _osvauco_agent_post(path: str, body: dict) -> Any:
     """Kaller osvauco-agent direkte med service-to-service auth."""