Header validation runs before method dispatch

How to fix this

A server returning -32601 (method/tool not found) instead of -32020 on a header-mismatch probe has revealed an ordering bug — it dispatched before validating headers.

How the validator checks this

Probe P3.2, against a streamable-http server on the modern protocol. What it reports:

pass

Header validation ran before method dispatch — the mismatch was caught rather than the tool lookup failing first

warn

Returned -32601 (method/tool not found) for a header mismatch, which means the tool was looked up before the header was validated. The spec requires rejecting the mismatch but does not state the ordering — this is our inference, not a quoted requirement.

info

Could not determine validation ordering from the response (code …)

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked heuristically: a fail is inferred rather than certain, so it bumps the overall grade up one level instead of being treated as certain non-compliance.

Checked in the same request as MCP-HDR-003.

Check your own server against this rule

The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.

Other Request metadata headers rules

• MCP-HDR-001Missing Mcp-Method rejected with 400 + HeaderMismatch
• MCP-HDR-002Missing Mcp-Name on tools/call rejected with 400 + HeaderMismatch
• MCP-HDR-003Mcp-Name header must match the request body
• MCP-HDR-004Missing MCP-Protocol-Version rejected (modern-only servers)
• MCP-HDR-005MCP-Protocol-Version header must match _meta.protocolVersion
• MCP-HDR-006Header names compared case-insensitively
• MCP-HDR-007Base64 sentinel-encoded header values decoded before comparison
• MCP-HDR-008Mcp-Param-{Name} validated against body when x-mcp-header is declared
• MCP-HDR-009Mcp-Param-{Name} containing invalid characters is rejected