MCP-HDR-005

MCP-Protocol-Version header must match _meta.protocolVersion

“The header value MUST match the io.modelcontextprotocol/protocolVersion field carried in the request body's _meta. If the values do not match, the server MUST reject the request with 400 Bad Request and a HeaderMismatch JSON-RPC error.” — spec anchor

How to fix this

Compare the `MCP-Protocol-Version` header against `io.modelcontextprotocol/protocolVersion` in the body's `_meta`. If they differ, reject with 400 Bad Request and a HeaderMismatch error.

Example: failing and passing

The header says 2025-11-25 while _meta says 2026-07-28, and the server answers normally.

Violates MCP-HDR-005 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2025-11-25
Mcp-Method: tools/list

{"jsonrpc": "2.0", "id": 1, "method": "tools/list",
  "params": {
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete", "tools": [], "ttlMs": 300000, "cacheScope": "public"}}

The server rejects the request because the header and _meta protocol versions differ, with 400 Bad Request and -32020.

Complies with MCP-HDR-005 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2025-11-25
Mcp-Method: tools/list

{"jsonrpc": "2.0", "id": 1, "method": "tools/list",
  "params": {
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "error": {"code": -32020, "message": "Header mismatch: MCP-Protocol-Version header value '2025-11-25' does not match body value '2026-07-28'"}}

Check your own server against MCP-HDR-005

Probe P3.5 checks MCP-HDR-005 in a request of its own, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: the Mcp-Method header explained.

Other Request metadata headers rules

MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
MCP-HDR-003Mcp-Name header must match the request body
MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
MCP-HDR-006Header names compared case-insensitively
MCP-HDR-007Base64 sentinel-encoded header values decoded before comparison
MCP-HDR-008Mcp-Param-{Name} validated against body when x-mcp-header is declared
MCP-HDR-009Mcp-Param-{Name} containing invalid characters is rejected
MCP-HDR-010Header validation runs before method dispatch