Base64 sentinel-encoded header values decoded before comparison

How to fix this

Decode Base64 sentinel-encoded header values before comparing them to the body. `Mcp-Name` and `Mcp-Param-{Name}` both permit the encoding, and comparing the encoded form rejects requests that actually match.

How the validator checks this

Probe P3.7, against a streamable-http server on the modern protocol. What it reports:

pass

Decoded the Base64 sentinel Mcp-Name before comparing it to the body

fail

Rejected a Base64 sentinel-encoded Mcp-Name that decodes to the body value — encoded values must be decoded before comparison

info

Inconclusive (HTTP …, code …)

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Check your own server against this rule

The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.

Other Request metadata headers rules

• MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
• MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
• MCP-HDR-003Mcp-Name header must match the request body
• MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
• MCP-HDR-005MCP-Protocol-Version header must match _meta.protocolVersion
• MCP-HDR-006Header names compared case-insensitively
• MCP-HDR-008Mcp-Param-{Name} validated against body when x-mcp-header is declared
• MCP-HDR-009Mcp-Param-{Name} containing invalid characters is rejected
• MCP-HDR-010Header validation runs before method dispatch