770 pages for headers.
Titles and paths first, then pages whose text carries it. Each row opens that page as this site last read it.
Build an MCP server
Model Context Protocol · in the page
docs/2024-11-05/develop/build-server
…"""Make a request to the NWS API with proper error handling.""" headers = {"User-Agent": USER_AGENT, "Accept": "application/geo+json"} async with httpx.AsyncClient() as client: try:…
Architecture overview
Model Context Protocol · in the page
docs/2024-11-05/learn/architecture
…authentication methods including bearer tokens, API keys, and custom headers. The transport layer abstracts communication details from the protocol layer, enabling the same JSON-RPC 2.0 message form…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2024-11-05/tutorials/security/authorization
…?? ""; }, }), ); app.use( cors({ origin: "*", exposedHeaders: ["Mcp-Session-Id"], }), ); app.use(createRequestLogger()); const mcpServerUrl = new URL(`http://${CONFIG.host}:${CONF…
Security Best Practices
Model Context Protocol · in the page
docs/2024-11-05/tutorials/security/security_best_practices
…* Web-based MCP clients **SHOULD** implement Content Security Policy headers to prevent JavaScript execution: * Set `script-src 'self'` to prevent execution of inline JavaScript * Use `default-src '…
Build an MCP server
Model Context Protocol · in the page
docs/2025-03-26/develop/build-server
…"""Make a request to the NWS API with proper error handling.""" headers = {"User-Agent": USER_AGENT, "Accept": "application/geo+json"} async with httpx.AsyncClient() as client: try:…
Architecture overview
Model Context Protocol · in the page
docs/2025-03-26/learn/architecture
…authentication methods including bearer tokens, API keys, and custom headers. MCP recommends using OAuth to obtain authentication tokens. The transport layer abstracts communication details from the…
Debugging
Model Context Protocol · in the page
docs/2025-03-26/tools/debugging
…rowser DevTools Network panel) to inspect requests, [`Mcp-Session-Id` headers](/specification/2025-03-26/basic/transports#session-management), and SSE streams. For all [transports](/specification/202…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2025-03-26/tutorials/security/authorization
…?? ""; }, }), ); app.use( cors({ origin: "*", exposedHeaders: ["Mcp-Session-Id"], }), ); app.use(createRequestLogger()); const mcpServerUrl = new URL(`http://${CONFIG.host}:${CONF…
Security Best Practices
Model Context Protocol · in the page
docs/2025-03-26/tutorials/security/security_best_practices
…* Web-based MCP clients **SHOULD** implement Content Security Policy headers to prevent JavaScript execution: * Set `script-src 'self'` to prevent execution of inline JavaScript * Use `default-src '…
Build an MCP server
Model Context Protocol · in the page
docs/2025-06-18/develop/build-server
…"""Make a request to the NWS API with proper error handling.""" headers = {"User-Agent": USER_AGENT, "Accept": "application/geo+json"} async with httpx.AsyncClient() as client: try:…
Architecture overview
Model Context Protocol · in the page
docs/2025-06-18/learn/architecture
…authentication methods including bearer tokens, API keys, and custom headers. MCP recommends using OAuth to obtain authentication tokens. The transport layer abstracts communication details from the…
Debugging
Model Context Protocol · in the page
docs/2025-06-18/tools/debugging
…rowser DevTools Network panel) to inspect requests, [`Mcp-Session-Id` headers](/specification/2025-06-18/basic/transports#session-management), and SSE streams. For all [transports](/specification/202…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2025-06-18/tutorials/security/authorization
…?? ""; }, }), ); app.use( cors({ origin: "*", exposedHeaders: ["Mcp-Session-Id"], }), ); app.use(createRequestLogger()); const mcpServerUrl = new URL(`http://${CONFIG.host}:${CONF…
Security Best Practices
Model Context Protocol · in the page
docs/2025-06-18/tutorials/security/security_best_practices
…* Web-based MCP clients **SHOULD** implement Content Security Policy headers to prevent JavaScript execution: * Set `script-src 'self'` to prevent execution of inline JavaScript * Use `default-src '…
Build an MCP server
Model Context Protocol · in the page
docs/2025-11-25/develop/build-server
…"""Make a request to the NWS API with proper error handling.""" headers = {"User-Agent": USER_AGENT, "Accept": "application/geo+json"} async with httpx.AsyncClient() as client: try:…
Architecture overview
Model Context Protocol · in the page
docs/2025-11-25/learn/architecture
…authentication methods including bearer tokens, API keys, and custom headers. MCP recommends using OAuth to obtain authentication tokens. The transport layer abstracts communication details from the…
Debugging
Model Context Protocol · in the page
docs/2025-11-25/tools/debugging
…rowser DevTools Network panel) to inspect requests, [`Mcp-Session-Id` headers](/specification/2025-11-25/basic/transports#session-management), and SSE streams. For all [transports](/specification/202…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2025-11-25/tutorials/security/authorization
…?? ""; }, }), ); app.use( cors({ origin: "*", exposedHeaders: ["Mcp-Session-Id"], }), ); app.use(createRequestLogger()); const mcpServerUrl = new URL(`http://${CONFIG.host}:${CONF…
Security Best Practices
Model Context Protocol · in the page
docs/2025-11-25/tutorials/security/security_best_practices
…* Web-based MCP clients **SHOULD** implement Content Security Policy headers to prevent JavaScript execution: * Set `script-src 'self'` to prevent execution of inline JavaScript * Use `default-src '…
Build an MCP server
Model Context Protocol · in the page
docs/2026-07-28/develop/build-server
…"""Make a request to the NWS API with proper error handling.""" headers = {"User-Agent": USER_AGENT, "Accept": "application/geo+json"} async with httpx2.AsyncClient() as client: try:…
Architecture overview
Model Context Protocol · in the page
docs/2026-07-28/learn/architecture
…authentication methods including bearer tokens, API keys, and custom headers. MCP recommends using OAuth to obtain authentication tokens. The transport layer abstracts communication details from the…
CLI client
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/cli
…list ``` When the server comes from a file, its per-server settings (headers, timeouts, OAuth, [protocol era](/docs/2026-07-28/tools/inspector/protocol-eras.md), and roots) apply to the connection, r…
Configuration and flags
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/configuration
…stdio server. Repeatable. | None | | `--header "Name: Value"` | HTTP headers for an HTTP/SSE server. Repeatable. | Requires an ad-hoc HTTP/SSE server on the web client. | | `--protocol-era <era>` | `…
Protocol eras
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/protocol-eras
…e, while unrelated traffic stays outside it. *** ## Tools: mirrored headers and excluded tools [SEP-2243](/seps/2243-http-standardization.md) lets a tool annotate an argument with `x-mcp-header`, a…
Security
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/security
…registration access tokens; * each stdio server's `env:` values. **`headers` are not secrets.** They are saved in `mcp.json` exactly as written, so a header that carries a credential (an API key, a…
Web client
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/web
…ns. | | **Network** | HTTP / SSE servers | The raw HTTP view: status, headers, bodies. | | **Console** | stdio servers | The server process's `stderr`. | **Network** and **Console** never appear toge…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2026-07-28/tutorials/security/authorization
…?? ""; }, }), ); app.use( cors({ origin: "*", exposedHeaders: ["Mcp-Session-Id"], }), ); app.use(createRequestLogger()); const mcpServerUrl = new URL(`http://${CONFIG.host}:${CONF…
Security Best Practices
Model Context Protocol · in the page
docs/2026-07-28/tutorials/security/security_best_practices
…* Web-based MCP clients **SHOULD** implement Content Security Policy headers to prevent JavaScript execution: * Set `script-src 'self'` to prevent execution of inline JavaScript * Use `default-src '…
Build an MCP server
Model Context Protocol · in the page
docs/draft/develop/build-server
…"""Make a request to the NWS API with proper error handling.""" headers = {"User-Agent": USER_AGENT, "Accept": "application/geo+json"} async with httpx2.AsyncClient() as client: try:…
Architecture overview
Model Context Protocol · in the page
docs/draft/learn/architecture
…authentication methods including bearer tokens, API keys, and custom headers. MCP recommends using OAuth to obtain authentication tokens. The transport layer abstracts communication details from the…
CLI client
Model Context Protocol · in the page
docs/draft/tools/inspector/cli
…list ``` When the server comes from a file, its per-server settings (headers, timeouts, OAuth, [protocol era](/docs/draft/tools/inspector/protocol-eras.md), and roots) apply to the connection, resolv…
Configuration and flags
Model Context Protocol · in the page
docs/draft/tools/inspector/configuration
…stdio server. Repeatable. | None | | `--header "Name: Value"` | HTTP headers for an HTTP/SSE server. Repeatable. | Requires an ad-hoc HTTP/SSE server on the web client. | | `--protocol-era <era>` | `…
Protocol eras
Model Context Protocol · in the page
docs/draft/tools/inspector/protocol-eras
…e, while unrelated traffic stays outside it. *** ## Tools: mirrored headers and excluded tools [SEP-2243](/seps/2243-http-standardization.md) lets a tool annotate an argument with `x-mcp-header`, a…
Security
Model Context Protocol · in the page
docs/draft/tools/inspector/security
…registration access tokens; * each stdio server's `env:` values. **`headers` are not secrets.** They are saved in `mcp.json` exactly as written, so a header that carries a credential (an API key, a…
Web client
Model Context Protocol · in the page
docs/draft/tools/inspector/web
…ns. | | **Network** | HTTP / SSE servers | The raw HTTP view: status, headers, bodies. | | **Console** | stdio servers | The server process's `stderr`. | **Network** and **Console** never appear toge…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/draft/tutorials/security/authorization
…?? ""; }, }), ); app.use( cors({ origin: "*", exposedHeaders: ["Mcp-Session-Id"], }), ); app.use(createRequestLogger()); const mcpServerUrl = new URL(`http://${CONFIG.host}:${CONF…
Security Best Practices
Model Context Protocol · in the page
docs/draft/tutorials/security/security_best_practices
…* Web-based MCP clients **SHOULD** implement Content Security Policy headers to prevent JavaScript execution: * Set `script-src 'self'` to prevent execution of inline JavaScript * Use `default-src '…
Publishing Remote Servers
Model Context Protocol · in the page
registry/remote-servers
…"default": "us-east-1" } } } ] } ``` ## HTTP Headers MCP clients can be instructed to send specific HTTP headers by adding the `headers` property to the `remotes` entry: ```…
SEP-2127: MCP Server Cards - HTTP Server Discovery
Model Context Protocol · in the page
seps/2127-mcp-server-cards
…/ `repository` / `websiteUrl`), its remote transport endpoints (URLs, headers, variable templates, supported protocol versions), and optional namespaced `_meta` data. `_meta` is not used to advertise…
SEP-2207: OIDC-Flavored Refresh Token Guidance
Model Context Protocol · in the page
seps/2207-oidc-refresh-token-guidance
…de `offline_access` in the `scope` parameter of `WWW-Authenticate` headers, as refresh tokens are not a resource requirement. 2. **SHOULD NOT** include `offline_access` in `scopes_supported` in Pr…
SEP-2243: HTTP Header Standardization for Streamable HTTP Transport
Model Context Protocol · in the page
seps/2243-http-standardization
…ransport. By mirroring key fields from the JSON-RPC payload into HTTP headers, network intermediaries such as load balancers, proxies, and observability tools can route and process MCP traffic without…
SEP-2484: Require Conformance Tests for Standards Track SEPs to Reach Final Status
Model Context Protocol · in the page
seps/2484-conformance-tests-required-for-final-seps
…es on the wire, transport-observable side effects (HTTP status codes, headers, connection lifecycle, OAuth redirects), or process-observable side effects for local transports (stdio stream content, ex…
SEP-2549: TTL for List Results
Model Context Protocol · in the page
seps/2549-TTL-for-list-results
…. While HTTP-based transports could theoretically use `Cache-Control` headers, MCP also operates over stdio, and supports pluggable transports where HTTP headers may not be available. Embedding the TT…
SEP-2575: Make MCP Stateless
Model Context Protocol · in the page
seps/2575-stateless-mcp
…rsion negotiation is handled per-request via `MCP-Protocol-Version` headers and `_meta` fields. Capability discovery is handled by `server/discover`. * `logging/setLevel`: Removed. The log level i…
SEP-2663: Tasks Extension
Model Context Protocol · in the page
seps/2663-tasks-extension
…tasks in general in this specification. ### Streamable HTTP: Routing Headers When `tasks/get`, `tasks/update`, or `tasks/cancel` is sent over the Streamable HTTP transport, the client **MUST** set t…
SEP-414: Document OpenTelemetry Trace Context Propagation Conventions
Model Context Protocol · in the page
seps/414-request-meta
…ll/2028) - builds on this SEP for forwarding `_meta` values to HTTP headers ## Backward Compatibility This SEP documents existing conventions and is backward compatible. ## Security Implications…
SEP-985: Align OAuth 2.0 Protected Resource Metadata with RFC 9728
Model Context Protocol · in the page
seps/985-align-oauth-20-protected-resource-metadata-with-rf
…end resource servers. In such deployments, injecting WWW-Authenticate headers from backend services is non-trivial due to separation of concerns and infrastructure complexity. In these scenarios, hav…
SEP-991: Enable URL-based Client Registration using OAuth Client ID Metadata Documents
Model Context Protocol · in the page
seps/991-enable-url-based-client-registration-using-oauth-c
…Server: Cache metadata for future requests<br/>(respecting HTTP cache headers) ``` ### Client Requirements * Clients MUST host their metadata document at an HTTPS URL following RFC requirements * Th…
Authorization
Model Context Protocol · in the page
specification/2025-03-26/basic/authorization
…Continue with authorization flow ``` #### Server Metadata Discovery Headers MCP clients *SHOULD* include the header `MCP-Protocol-Version: <protocol-version>` during Server Metadata Discovery to al…
Authorization
Model Context Protocol · in the page
specification/2025-06-18/basic/authorization
…-response). MCP clients **MUST** be able to parse `WWW-Authenticate` headers and respond appropriately to `HTTP 401 Unauthorized` responses from the MCP server. #### Server Metadata Discovery MCP c…