MCP-SEC-007

Server does not reflect the Authorization header into responses

This rule's verbatim spec quote hasn't been captured yet — see validator/README.md. It is not yet counted toward coverage or graded.

How to fix this

House security rule, not a literal MCP spec requirement.

How the validator checks this

Probe P8.1, against a streamable-http server on the modern protocol. What it reports:

pass: The Authorization header was not reflected into the response
fail: The Authorization header was reflected back in the response — a credential must never appear in a response body or header

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-AUT-001, MCP-AUT-006, MCP-AUT-007, MCP-AUT-008.

How often this is violated

Of the 5 servers where this rule could be evaluated, 0 did not satisfy it.

Counted across public validation reports, one server counted once. Servers where the rule could not be checked are excluded from both figures — they say nothing either way.

Check your own server against this rule

The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.