Skip to content

feat(conformance): add SEP-2243 header validation tool#997

Open
jstar0 wants to merge 1 commit into
modelcontextprotocol:mainfrom
jstar0:feat/sep-2243-server-header-validation
Open

feat(conformance): add SEP-2243 header validation tool#997
jstar0 wants to merge 1 commit into
modelcontextprotocol:mainfrom
jstar0:feat/sep-2243-server-header-validation

Conversation

@jstar0

@jstar0 jstar0 commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Summary

Expose a conformance tool that exercises server-side SEP-2243 custom parameter header validation.

The Streamable HTTP transport already validates Mcp-Param-* headers using the called tool's input schema. The conformance server did not advertise any tool with an x-mcp-header annotation, so the http-custom-header-server-validation scenario could not exercise that implementation.

Changes

  • Add a test_custom_header tool with a required string parameter promoted to Mcp-Param-Value.
  • Return the same tool definition from get_tool so the transport can cache its schema before handler dispatch.
  • Expose the tool through tools/list and echo the validated value from tools/call.
  • Add a regression test for the transport-facing tool schema.
  • Add a transport regression for a valid Base64 header whose decoded value mismatches the body parameter.
  • Run the server unit test and the pinned custom-header scenario in the 2026-07-28 conformance workflow.

The patch reuses the existing transport validation and does not add another header parser or Base64 decoder.

Verification

cargo test -p mcp-conformance --all-features
cargo test -p rmcp --test test_streamable_http_standard_headers --features server,client,transport-streamable-http-server,reqwest
cargo test --all-features
cargo fmt --all -- --check

The pinned @modelcontextprotocol/conformance@0.2.0-alpha.9 http-custom-header-server-validation scenario also passes all 9 emitted checks, including valid and invalid Base64 values, literal prefix/suffix boundaries, missing custom headers, and JSON-RPC error code -32020. The repository integration test separately covers a syntactically valid Base64 value that decodes to a different body value.

Closes #979

@github-actions github-actions Bot added T-test Testing related changes T-CI Changes to CI/CD workflows and configuration T-config Configuration file changes labels Jul 15, 2026
@jstar0 jstar0 marked this pull request as ready for review July 15, 2026 19:56
@jstar0 jstar0 requested a review from a team as a code owner July 15, 2026 19:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

T-CI Changes to CI/CD workflows and configuration T-config Configuration file changes T-test Testing related changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement SEP-2243: server-side custom header validation

1 participant