Base64 sentinel-encoded header values decoded before comparison

How to fix this

Decode Base64 sentinel-encoded header values before comparing them to the body. `Mcp-Name` and `Mcp-Param-{Name}` both permit the encoding, and comparing the encoded form rejects requests that actually match.

How the validator checks this

Probe P3.7, against a streamable-http server on the modern protocol. What it reports:

pass

Decoded the Base64 sentinel Mcp-Name before comparing it to the body

fail

Rejected a Base64 sentinel-encoded Mcp-Name that decodes to the body value — encoded values must be decoded before comparison

info

Inconclusive — the server does not reject a mismatched Mcp-Name in either form (see MCP-HDR-003), so whether it decodes encoded values cannot be observed

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Check your own server against MCP-HDR-007

Probe P3.7 checks MCP-HDR-007 in a request of its own, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: the Mcp-Method header explained.

Other Request metadata headers rules

• MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
• MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
• MCP-HDR-003Mcp-Name header must match the request body
• MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
• MCP-HDR-005MCP-Protocol-Version header must match _meta.protocolVersion
• MCP-HDR-006Header names compared case-insensitively
• MCP-HDR-008Mcp-Param-{Name} validated against body when x-mcp-header is declared
• MCP-HDR-009Mcp-Param-{Name} containing invalid characters is rejected
• MCP-HDR-010Header validation runs before method dispatch