MCP-HDR-008

Mcp-Param-{Name} validated against body when x-mcp-header is declared

“Any server that processes the message body MUST validate that encoded header values, after decoding if Base64-encoded, match the corresponding values in the request body.” — spec anchor

How to fix this

When a tool declares `x-mcp-header`, validate each `Mcp-Param-{Name}` against the matching value in the request body, decoding Base64 first.

Example: failing and passing

The execute_sql tool marks region with x-mcp-header "Region", but the server ignores that Mcp-Param-Region (us-east1) disagrees with the body (us-west1).

Violates MCP-HDR-008 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: execute_sql
Mcp-Param-Region: us-east1

{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": {"name": "execute_sql",
    "arguments": {"region": "us-west1", "query": "SELECT * FROM users"},
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete", "content": [{"type": "text", "text": "3 rows"}], "isError": false}}

The server compares Mcp-Param-Region with arguments.region, finds a mismatch, and rejects the request with 400 Bad Request and -32020.

Complies with MCP-HDR-008 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: execute_sql
Mcp-Param-Region: us-east1

{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": {"name": "execute_sql",
    "arguments": {"region": "us-west1", "query": "SELECT * FROM users"},
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "error": {"code": -32020, "message": "Header mismatch: Mcp-Param-Region header value 'us-east1' does not match body value 'us-west1'"}}

How the validator checks this

This rule is catalogued from the specification but is not yet checked automatically. No probe emits a finding for it, so it never appears in a report as pass, warn or fail. It is documented here because it is a real requirement of the specification — it is simply not one this validator can confirm for you yet.

Check your own server against MCP-HDR-008

The validator does not check MCP-HDR-008 automatically yet, so confirm it by hand against the examples above. It does check 73 of the 79 rules — validate a server to see those.

Background on this topic: the Mcp-Method header explained.

Other Request metadata headers rules

MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
MCP-HDR-003Mcp-Name header must match the request body
MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
MCP-HDR-005MCP-Protocol-Version header must match _meta.protocolVersion
MCP-HDR-006Header names compared case-insensitively
MCP-HDR-007Base64 sentinel-encoded header values decoded before comparison
MCP-HDR-009Mcp-Param-{Name} containing invalid characters is rejected
MCP-HDR-010Header validation runs before method dispatch