Error messages do not echo request headers or credentials

How to fix this

House security rule, not a literal MCP spec requirement.

How the validator checks this

Probe P3.1, against a streamable-http server on the modern protocol. What it reports:

pass

A distinctive request header was not reflected in the response body

warn

The response body reflected a request header value back verbatim. Echoing request headers is how a proxy-injected or credential-bearing header ends up in a log or an error page.

skip

The server returned no body, so there was nothing that could echo a request header

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked heuristically: a fail is inferred rather than certain, so it bumps the overall grade up one level instead of being treated as certain non-compliance.

Checked in the same request as MCP-HDR-001.

Check your own server against this rule

The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.

Other Security posture rules

• MCP-SEC-001Invalid Origin header returns HTTP 403
• MCP-SEC-002Endpoint is HTTPS with a valid, unexpired certificate chain
• MCP-SEC-004icons[].src is https: or data:, same-origin, no unsafe scheme
• MCP-SEC-005No $ref in tool schemas resolves to a network URI
• MCP-SEC-006Schema depth and subschema count stay within safe bounds
• MCP-SEC-007Server does not reflect the Authorization header into responses