GeezerVison is showing github.com — Validate SEP-2243 Mcp-Param headers in the modern server by Kehrlann · Pull Request #1286 · modelcontextprotocol/java-sdk
Conversation
Kehrlann
commented
Oct 26, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
Closes #1199
- Tools can mark inputSchema arguments with x-mcp-header, so clients mirror them into Mcp-Param-{Name} headers. Servers MUST reject a request whose headers and body disagree, with 400 / -32020.
- Since only tools/call use those header, they are not part of the McpRequestHandler interface, and rather are carried through the McpTransportContext.
- The HTTP transport extracts and decodes Mcp-Param-* headers and puts them in the context. STDIO puts a marker "not mirrored" value instead.
- Validation happens in ToolsFeature, where we have both the tool definition (including x-mcp-header annotations in the schema) and the values for the tool call.
- McpHeaderDecoder and McpParamHeaders are public, so other HTTP transports can reuse them.
- Mcp-Name now uses the same strict decoder.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
- Tools can mark inputSchema arguments with x-mcp-header, so clients
mirror them into Mcp-Param-{Name} headers. Servers MUST reject a
request whose headers and body disagree, with 400 / -32020.
- Since only tools/call use those header, they are not part of the
McpRequestHandler interface, and rather are carried through the
McpTransportContext.
- The HTTP transport extracts and decodes Mcp-Param-* headers and puts
them in the context. STDIO puts a marker "not mirrored" value instead.
- Validation happens in ToolsFeature, where we have both the tool
definition (including x-mcp-header annotations in the schema) and the
values for the tool call.
- McpHeaderDecoder and McpParamHeaders are public, so other HTTP
transports can reuse them.
- Mcp-Name now uses the same strict decoder.
Signed-off-by: Daniel Garnier-Moiroux <[email protected]>
Uh oh!
There was an error while loading. Please reload this page.
Reviewers
chemicL
Awaiting requested review from chemicL
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.