Header names compared case-insensitively

How to fix this

Compare header names case-insensitively, per RFC 9110. `mcp-method`, `Mcp-Method` and `MCP-METHOD` are the same field, and rejecting one of them rejects a valid request.

How the validator checks this

Probe P3.6, against a streamable-http server on the modern protocol. What it reports:

pass

Accepted headers spelled in a different case, as RFC 9110 requires

fail

Rejected a valid request whose header names differed only in case (HTTP …, code …). Header field names are case-insensitive.

info

Inconclusive — the case-variant request returned HTTP … for a reason other than header validation

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Check your own server against this rule

The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.

Other Request metadata headers rules

• MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
• MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
• MCP-HDR-003Mcp-Name header must match the request body
• MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
• MCP-HDR-005MCP-Protocol-Version header must match _meta.protocolVersion
• MCP-HDR-007Base64 sentinel-encoded header values decoded before comparison
• MCP-HDR-008Mcp-Param-{Name} validated against body when x-mcp-header is declared
• MCP-HDR-009Mcp-Param-{Name} containing invalid characters is rejected
• MCP-HDR-010Header validation runs before method dispatch