MCP-HDR-003

Mcp-Name header must match the request body

“Servers that process the request body MUST reject requests where the values specified in the headers do not match the corresponding values in the request body.” — spec anchor

How to fix this

If you read the request body, compare `Mcp-Name` against the corresponding body value and reject a mismatch with 400 and `-32020`. Validate headers before dispatching the method, so an unknown tool name cannot mask the header error.

Example: failing and passing

Mcp-Name says get_weather but the body calls delete_records, and the server executes the body's tool.

Violates MCP-HDR-003 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: get_weather

{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": {"name": "delete_records", "arguments": {},
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete", "content": [{"type": "text", "text": "Deleted 120 records"}], "isError": false}}

The server sees that Mcp-Name and params.name disagree and rejects the request with 400 Bad Request and -32020.

Complies with MCP-HDR-003 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: get_weather

{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": {"name": "delete_records", "arguments": {},
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "error": {"code": -32020, "message": "Header mismatch: Mcp-Name header value 'get_weather' does not match body value 'delete_records'"}}

Check your own server against MCP-HDR-003

Probe P3.2 checks MCP-HDR-003 in the same request as 1 other rule, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: the Mcp-Method header explained.

Other Request metadata headers rules

MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
MCP-HDR-005MCP-Protocol-Version header must match _meta.protocolVersion
MCP-HDR-006Header names compared case-insensitively
MCP-HDR-007Base64 sentinel-encoded header values decoded before comparison
MCP-HDR-008Mcp-Param-{Name} validated against body when x-mcp-header is declared
MCP-HDR-009Mcp-Param-{Name} containing invalid characters is rejected
MCP-HDR-010Header validation runs before method dispatch