MCP-SEC-007

Server does not reflect the Authorization header into responses

This rule's verbatim spec quote hasn't been captured yet — see validator/README.md. It is not yet counted toward coverage or graded.

How to fix this

House security rule, not a literal MCP spec requirement.

Example: failing and passing

The 401 body echoes the bearer token the client sent, putting the credential into a response that may be logged or cached.

Violates MCP-SEC-007 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Authorization: Bearer tok_8f3a91c2e7d4
Mcp-Method: tools/list
...

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token",
                         resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"
Content-Type: text/plain

Rejected token tok_8f3a91c2e7d4

The server rejects the token without repeating it anywhere in the response headers or body.

Complies with MCP-SEC-007 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Authorization: Bearer tok_8f3a91c2e7d4
Mcp-Method: tools/list
...

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token",
                         resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"
Content-Type: text/plain

Rejected token

How the validator checks this

Probe P8.1, against a streamable-http server on the modern protocol. What it reports:

pass: The Authorization header was not reflected into the response
fail: The Authorization header was reflected back in the response — a credential must never appear in a response body or header

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-AUT-001, MCP-AUT-006, MCP-AUT-007, MCP-AUT-008.

How often this is violated

Of the 6 servers where this rule could be evaluated, 0 did not satisfy it.

Counted across public validation reports, one server counted once. Servers where the rule could not be checked are excluded from both figures — they say nothing either way.

Check your own server against MCP-SEC-007

Probe P8.1 checks MCP-SEC-007 in the same request as 4 other rules, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.