MCP-HDR-006

Header names compared case-insensitively

“Header names (called "field names" in RFC 9110) are case-insensitive. Clients and servers MUST use case-insensitive comparisons for header names.” — spec anchor

How to fix this

Compare header names case-insensitively, per RFC 9110. `mcp-method`, `Mcp-Method` and `MCP-METHOD` are the same field, and rejecting one of them rejects a valid request.

Example: failing and passing

The header names are spelled in upper case, and the server treats Mcp-Method as missing.

Violates MCP-HDR-006 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
CONTENT-TYPE: application/json
MCP-PROTOCOL-VERSION: 2026-07-28
MCP-METHOD: tools/list

{"jsonrpc": "2.0", "id": 1, "method": "tools/list",
  "params": {
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "error": {"code": -32020, "message": "Header mismatch: required header Mcp-Method is missing"}}

The server matches header names case-insensitively, so the same request succeeds.

Complies with MCP-HDR-006 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
CONTENT-TYPE: application/json
MCP-PROTOCOL-VERSION: 2026-07-28
MCP-METHOD: tools/list

{"jsonrpc": "2.0", "id": 1, "method": "tools/list",
  "params": {
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete", "tools": [], "ttlMs": 300000, "cacheScope": "public"}}

How the validator checks this

Probe P3.6, against a streamable-http server on the modern protocol. What it reports:

pass: Accepted headers spelled in a different case, as RFC 9110 requires
fail: Rejected a valid request whose header names differed only in case (HTTP …, code …). Header field names are case-insensitive.
info: Inconclusive — the case-variant request returned HTTP … for a reason other than header validation

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Check your own server against MCP-HDR-006

Probe P3.6 checks MCP-HDR-006 in a request of its own, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: the Mcp-Method header explained.

Other Request metadata headers rules

MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
MCP-HDR-003Mcp-Name header must match the request body
MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
MCP-HDR-005MCP-Protocol-Version header must match _meta.protocolVersion
MCP-HDR-007Base64 sentinel-encoded header values decoded before comparison
MCP-HDR-008Mcp-Param-{Name} validated against body when x-mcp-header is declared
MCP-HDR-009Mcp-Param-{Name} containing invalid characters is rejected
MCP-HDR-010Header validation runs before method dispatch