MCP-ERR-006

Missing required _meta field returns HTTP 400 + JSON-RPC -32602

“A request missing any required field is malformed; the server MUST reject it with JSON-RPC error code -32602 (Invalid params). On HTTP, the response status MUST be 400 Bad Request.” — spec anchor

How to fix this

Reject a request missing a required `_meta` field with HTTP 400 and `-32602`. A missing required field makes the request malformed, not merely incomplete.

Example: failing and passing

The request has no _meta, so the required protocolVersion and clientCapabilities are missing, yet the server answers it.

Violates MCP-ERR-006 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/list

{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {}}

HTTP/1.1 200 OK
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete", "tools": [], "ttlMs": 300000, "cacheScope": "public"}}

The server rejects the request missing required _meta fields with 400 Bad Request and -32602 (Invalid params).

Complies with MCP-ERR-006 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/list

{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {}}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "error": {"code": -32602, "message": "Invalid params: missing required _meta field io.modelcontextprotocol/protocolVersion"}}

How the validator checks this

Probe P4.1, against a streamable-http server on the modern protocol. What it reports:

pass: Missing required _meta rejected with 400 and -32602
warn: Returned -32602 for missing _meta but HTTP … rather than 400
fail: Accepted a request with no _meta — required fields are missing, so it must be rejected with 400 and -32602

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-ERR-007.

Check your own server against MCP-ERR-006

Probe P4.1 checks MCP-ERR-006 in the same request as 1 other rule, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: MCP error codes explained.

Other Error codes rules

MCP-ERR-001Unsupported version returns -32022 with data.supported[]
MCP-ERR-002Unknown method returns HTTP 404 and JSON-RPC -32601
MCP-ERR-003Resource-not-found uses -32602, not the retired -32002
MCP-ERR-004The retired -32042 code is never emitted
MCP-ERR-005No undefined code is emitted in the reserved -32020…-32099 range
MCP-ERR-007Missing client capability returns -32021 with data.requiredCapabilities
MCP-ERR-008New implementation-defined codes avoid the legacy -32000…-32019 range