MCP-HDR-009

Mcp-Param-{Name} containing invalid characters is rejected

“Servers MUST reject requests with a recognized Mcp-Param-{Name} header that contains invalid characters.” — spec anchor

How to fix this

Reject a recognised `Mcp-Param-{Name}` whose value contains characters outside the permitted set, rather than forwarding it to the tool.

Example: failing and passing

The tool marks greeting with x-mcp-header "Greeting", and the server accepts a Mcp-Param-Greeting value containing raw non-ASCII characters.

Violates MCP-HDR-009 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: send_greeting
Mcp-Param-Greeting: Hello, 世界

{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": {"name": "send_greeting", "arguments": {"greeting": "Hello, 世界"},
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete", "content": [{"type": "text", "text": "Sent"}], "isError": false}}

The server rejects the recognized Mcp-Param-Greeting header because it contains characters outside the allowed ASCII set, with 400 Bad Request and -32020.

Complies with MCP-HDR-009 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: send_greeting
Mcp-Param-Greeting: Hello, 世界

{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": {"name": "send_greeting", "arguments": {"greeting": "Hello, 世界"},
    "_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28",
              "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "error": {"code": -32020, "message": "Header mismatch: Mcp-Param-Greeting contains invalid characters"}}

How the validator checks this

This rule is catalogued from the specification but is not yet checked automatically. No probe emits a finding for it, so it never appears in a report as pass, warn or fail. It is documented here because it is a real requirement of the specification — it is simply not one this validator can confirm for you yet.

Check your own server against MCP-HDR-009

The validator does not check MCP-HDR-009 automatically yet, so confirm it by hand against the examples above. It does check 73 of the 79 rules — validate a server to see those.

Background on this topic: the Mcp-Method header explained.

Other Request metadata headers rules

MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
MCP-HDR-003Mcp-Name header must match the request body
MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
MCP-HDR-005MCP-Protocol-Version header must match _meta.protocolVersion
MCP-HDR-006Header names compared case-insensitively
MCP-HDR-007Base64 sentinel-encoded header values decoded before comparison
MCP-HDR-008Mcp-Param-{Name} validated against body when x-mcp-header is declared
MCP-HDR-010Header validation runs before method dispatch