StandardHeaderValidator
Checks that a request's HTTP headers agree with its JSON-RPC body (SEP-2243).
The headers let an intermediary route MCP traffic without parsing the body, which only holds if the two cannot disagree — otherwise a caller could show a gateway one request and the server another.
Tags
Table of Contents
Constants
- METHOD_HEADER : mixed = \Mcp\Schema\Wire\McpHeader::METHOD
- NAME_HEADER : mixed = \Mcp\Schema\Wire\McpHeader::NAME
- PARAM_HEADER_PREFIX : mixed = \Mcp\Schema\Wire\McpHeader::PARAM_PREFIX
Properties
- $registry : RegistryInterface|null
Methods
- __construct() : mixed
- decode() : string|null
- Unwraps a `=?base64?…?=` value, or returns a plain value unchanged.
- mirroredProperties() : array<string, array<int, string>>
- Every `x-mcp-header` annotation in $schema, as header name to the property path it mirrors.
- nameFor() : string|null
- The subject of a request, per method. Anything unlisted is exempt.
- validate() : string|null
- checkMethod() : string|null
- checkName() : string|null
- When the body carries a name the header must repeat it; when it does not, the server must not demand one.
- checkParam() : string|null
- checkParams() : string|null
- Only headers the tool itself declares are checked: an unrecognized `Mcp-Param-*` belongs to somebody else in the chain, and intermediaries are meant to forward what they do not understand.
- header() : string|null
- Case-insensitive name, whitespace-trimmed value (RFC 9110 §5.5).
- valueAt() : mixed
- Reads the instance value at an exact property path, or null when the path is not present — which the specification reads as "no header expected".
Constants
METHOD_HEADER
public
mixed
METHOD_HEADER
= \Mcp\Schema\Wire\McpHeader::METHOD
NAME_HEADER
public
mixed
NAME_HEADER
= \Mcp\Schema\Wire\McpHeader::NAME
PARAM_HEADER_PREFIX
public
mixed
PARAM_HEADER_PREFIX
= \Mcp\Schema\Wire\McpHeader::PARAM_PREFIX
Properties
$registry read-only
private
RegistryInterface|null
$registry
= null
Methods
__construct()
public
__construct([RegistryInterface|null $registry = null ]) : mixed
Parameters
- $registry : RegistryInterface|null = null
decode()
Unwraps a `=?base64?…?=` value, or returns a plain value unchanged.
public
static decode(string $value) : string|null
Parameters
- $value : string
Return values
string|nullmirroredProperties()
Every `x-mcp-header` annotation in $schema, as header name to the property path it mirrors.
public
static mirroredProperties(array<string, mixed> $schema[, array<int, string> $path = [] ]) : array<string, array<int, string>>
Only statically reachable properties count: the chain from the root must
be properties keys the whole way. A chain through items, a
composition keyword, if/then/else or a $ref is not extractable
without evaluating the instance, so the specification puts an annotation
there out of bounds — and this walk simply never reaches one.
Parameters
- $schema : array<string, mixed>
- $path : array<int, string> = []
Return values
array<string, array<int, string>>nameFor()
The subject of a request, per method. Anything unlisted is exempt.
public
static nameFor(string $method, array<string, mixed>|null $params) : string|null
Parameters
- $method : string
- $params : array<string, mixed>|null
Return values
string|nullvalidate()
public
validate(string $method, array<string, mixed>|null $params, array<string, string> $headers) : string|null
Parameters
- $method : string
- $params : array<string, mixed>|null
- $headers : array<string, string>
Return values
string|null —the reason to reject, or null when the request is consistent
checkMethod()
private
checkMethod(string $method, array<string, string> $headers) : string|null
Parameters
- $method : string
- $headers : array<string, string>
Return values
string|nullcheckName()
When the body carries a name the header must repeat it; when it does not, the server must not demand one.
private
checkName(string $method, array<string, mixed>|null $params, array<string, string> $headers) : string|null
Parameters
- $method : string
- $params : array<string, mixed>|null
- $headers : array<string, string>
Return values
string|nullcheckParam()
private
checkParam(string $headerName, array<string, string> $headers, mixed $argument) : string|null
Parameters
- $headerName : string
- $headers : array<string, string>
- $argument : mixed
Return values
string|nullcheckParams()
Only headers the tool itself declares are checked: an unrecognized `Mcp-Param-*` belongs to somebody else in the chain, and intermediaries are meant to forward what they do not understand.
private
checkParams(string $method, array<string, mixed>|null $params, array<string, string> $headers) : string|null
Parameters
- $method : string
- $params : array<string, mixed>|null
- $headers : array<string, string>
Return values
string|nullheader()
Case-insensitive name, whitespace-trimmed value (RFC 9110 §5.5).
private
header(array<string, string> $headers, string $name) : string|null
Parameters
- $headers : array<string, string>
- $name : string
Return values
string|nullvalueAt()
Reads the instance value at an exact property path, or null when the path is not present — which the specification reads as "no header expected".
private
static valueAt(array<string, mixed> $arguments, array<int, string> $path) : mixed
Parameters
- $arguments : array<string, mixed>
- $path : array<int, string>