70f7ba0004The sep-2243 scenario check IDs drifted from the requirement-traceability yaml in #259 — the code emitted one ID per test case while the yaml declares one per normative requirement, so the IDs no longer matched. Rename the emitted IDs so a check ID maps to a single MUST/SHOULD and is emitted once per case (the per-case detail moves to name/description), matching the repo's existing 'same id, vary status/message' convention: - mcp-method-header-* / mcp-name-header-* -> client-includes-standard-headers - reject-invalid-tool-* / keep-valid-tool -> client-reject-invalid-tool - server-accepts-{lower,upper}case-name -> header-name-case-insensitive - server reject status checks (mismatch/missing/case x method/name) -> server-reject-invalid-headers - their error-code variants -> server-reject-error-code Merge the yaml's server-reject-mismatch + server-reject-status into one server-reject-invalid-headers MUST (HTTP 400 on a header-validation failure); keep server-reject-error-code as the SHOULD. Base64/custom-header rejection checks keep their own param-validation IDs (out of scope here). Gates and the whitespace-acceptance check keep their scenario-matching names. No behavior change — only check IDs, descriptions, and the yaml.
57 lines
4.9 KiB
YAML
57 lines
4.9 KiB
YAML
sep: 2243
|
|
spec_url: https://modelcontextprotocol.io/specification/draft/basic/transports#standard-mcp-request-headers
|
|
requirements:
|
|
- check: sep-2243-client-includes-standard-headers
|
|
text: 'The client MUST include the standard MCP request headers on each POST request. These headers are REQUIRED for compliance.'
|
|
- check: sep-2243-header-name-case-insensitive
|
|
text: 'Clients and servers MUST use case-insensitive comparisons for header names.'
|
|
- check: sep-2243-server-reject-invalid-headers
|
|
text: 'Servers that process the request body MUST reject requests with mismatched or missing standard-header values, returning HTTP 400 Bad Request.'
|
|
- check: sep-2243-server-reject-error-code
|
|
text: 'When rejecting a request due to header validation failure, servers SHOULD include a JSON-RPC error response using error code -32001.'
|
|
- check: sep-2243-client-supports-custom-headers
|
|
text: 'MCP clients MUST support this feature [custom headers via x-mcp-header].'
|
|
- check: sep-2243-client-mirrors-designated-params
|
|
text: 'When a client invokes a tool whose definition includes such designations, conforming clients MUST mirror the designated parameter values into HTTP headers as described below.'
|
|
- check: sep-2243-x-mcp-header-not-empty
|
|
text: 'The x-mcp-header value MUST NOT be empty.'
|
|
url: https://modelcontextprotocol.io/specification/draft/server/tools#custom-headers
|
|
- check: sep-2243-x-mcp-header-charset
|
|
text: 'The x-mcp-header value MUST contain only ASCII characters (excluding space and `:`).'
|
|
url: https://modelcontextprotocol.io/specification/draft/server/tools#custom-headers
|
|
- check: sep-2243-x-mcp-header-unique
|
|
text: 'The x-mcp-header value MUST be case-insensitively unique within a single tool definition.'
|
|
url: https://modelcontextprotocol.io/specification/draft/server/tools#custom-headers
|
|
- check: sep-2243-x-mcp-header-primitive-only
|
|
text: 'x-mcp-header MUST only be applied to parameters with primitive types (number, string, or boolean).'
|
|
url: https://modelcontextprotocol.io/specification/draft/server/tools#custom-headers
|
|
- check: sep-2243-client-reject-invalid-tool
|
|
text: 'Clients MUST reject tool definitions where any x-mcp-header value violates these constraints. Rejection means the client MUST exclude the invalid tool from the set of tools returned by tools/list.'
|
|
url: https://modelcontextprotocol.io/specification/draft/server/tools#custom-headers
|
|
- check: sep-2243-client-encode-values
|
|
text: 'Clients MUST encode parameter values before including them in HTTP headers: number values MUST be converted to their decimal string representation; boolean values MUST be converted to the lowercase strings "true" or "false".'
|
|
- check: sep-2243-client-base64-unsafe
|
|
text: 'When a value cannot be safely represented as plain ASCII (e.g., contains non-ASCII characters, control characters, or leading/trailing whitespace), clients MUST use Base64 encoding of the UTF-8 representation, wrapped as =?base64?{encoded}?=.'
|
|
- check: sep-2243-server-decode-base64
|
|
text: 'Servers and intermediaries that need to inspect these values MUST decode them accordingly.'
|
|
- check: sep-2243-client-omit-null
|
|
text: 'Parameter value is null or omitted: Client MUST omit the header.'
|
|
- check: sep-2243-server-not-expect-null
|
|
text: 'Parameter value is null or omitted: Server MUST NOT expect the header.'
|
|
- check: sep-2243-server-reject-missing-required
|
|
text: 'Required parameter is omitted: Server MUST reject with JSON-RPC error.'
|
|
- check: sep-2243-server-reject-invalid-param-chars
|
|
text: 'Servers MUST reject requests with a recognized Mcp-Param-{Name} header that contain invalid characters.'
|
|
- check: sep-2243-server-validate-param-match
|
|
text: 'Any server that processes the message body MUST validate that encoded header values, after decoding if Base64-encoded, match the corresponding parameter values in the body.'
|
|
- check: sep-2243-server-reject-param-mismatch
|
|
text: 'Servers MUST reject requests with a 400 Bad Request HTTP status and JSON-RPC error code -32001 if any validation fails.'
|
|
|
|
- text: 'Clients SHOULD log a warning when rejecting a tool definition due to invalid x-mcp-header, including the tool name and the reason.'
|
|
excluded: 'Log output is not wire-observable.'
|
|
- text: 'Server developers SHOULD NOT mark sensitive parameters (such as passwords, API keys, tokens, or PII) with x-mcp-header.'
|
|
excluded: 'Design guidance to humans; not protocol-observable.'
|
|
- text: 'Intermediaries MUST return an appropriate HTTP error status for validation failures.'
|
|
excluded: 'Intermediary requirement; conformance harness tests clients and servers, not intermediaries.'
|
|
- text: 'Intermediate servers that do not recognize an Mcp-Param-{Name} header MUST forward it and otherwise ignore it.'
|
|
excluded: 'Intermediary requirement; conformance harness tests clients and servers, not intermediaries.'
|