768 pages for headers.

Key Changes Model Context Protocol · in the page specification/2025-11-25/changelog …that servers must respond with HTTP 403 Forbidden for invalid Origin headers in Streamable HTTP transport. (PR [#1439](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1439)) 4. Upda… Authorization Server Discovery Model Context Protocol · in the page specification/2026-07-28/basic/authorization/authorization-server-discovery …and use the resource metadata URL from the parsed `WWW-Authenticate` headers when present; otherwise, they **MUST** fall back to constructing and requesting the well-known URIs in the order listed ab… Client Registration Model Context Protocol · in the page specification/2026-07-28/basic/authorization/client-registration …hes the URL exactly * **SHOULD** cache metadata respecting HTTP cache headers * **MUST** validate redirect URIs presented in an authorization request against those in the metadata document * **MUST**… Overview Model Context Protocol · in the page specification/2026-07-28/basic/index …Fetch icons without credentials. Do not send cookies, `Authorization` headers, or client credentials. * Verify that icon URIs are from the same origin as the server. This minimizes the risk of exposin… Overview Model Context Protocol · in the page specification/2026-07-28/basic/transports/index …elope metadata. The Streamable HTTP transport mirrors them into [HTTP headers](/specification/2026-07-28/basic/transports/streamable-http.md#request-metadata) so that intermediaries can route and insp… Streamable HTTP Model Context Protocol · in the page specification/2026-07-28/basic/transports/streamable-http …d content types. 3. The client **MUST** include the [request metadata headers](#request-metadata) on each POST request. 4. The body of the HTTP POST **MUST** be a single JSON-RPC *request* or *n… Versioning and Compatibility Model Context Protocol · in the page specification/2026-07-28/basic/versioning …e required `_meta` fields). HTTP: the request is missing the required headers and is rejected per [server validation](/specification/2026-07-28/basic/transports/streamable-http.md#server-validation) w… Key Changes Model Context Protocol · in the page specification/2026-07-28/changelog …d improve LLM prompt cache hit rates. 4. Require standard MCP request headers (`Mcp-Method`, `Mcp-Name`) on Streamable HTTP POST requests, and add support for custom headers from tool parameters via `… Schema Reference Model Context Protocol · in the page specification/2026-07-28/schema …ass="tsd-comment tsd-typography"><p>Error code returned when the HTTP headers of a request do not match the corresponding values in the request body, or required headers are missing or malformed.<… Tools Model Context Protocol · in the page specification/2026-07-28/server/tools …er`](#x-mcp-header) annotation to expose parameter values as HTTP headers * `outputSchema`: Optional JSON Schema defining expected output structure * Follows the [JSON Schema usage guidelines](/… Authorization Server Discovery Model Context Protocol · in the page specification/draft/basic/authorization/authorization-server-discovery …and use the resource metadata URL from the parsed `WWW-Authenticate` headers when present; otherwise, they **MUST** fall back to constructing and requesting the well-known URIs in the order listed ab… Client Registration Model Context Protocol · in the page specification/draft/basic/authorization/client-registration …hes the URL exactly * **SHOULD** cache metadata respecting HTTP cache headers * **MUST** validate redirect URIs presented in an authorization request against those in the metadata document * **MUST**… Overview Model Context Protocol · in the page specification/draft/basic/index …Fetch icons without credentials. Do not send cookies, `Authorization` headers, or client credentials. * Verify that icon URIs are from the same origin as the server. This minimizes the risk of exposin… Overview Model Context Protocol · in the page specification/draft/basic/transports/index …elope metadata. The Streamable HTTP transport mirrors them into [HTTP headers](/specification/draft/basic/transports/streamable-http.md#request-metadata) so that intermediaries can route and inspect r… Streamable HTTP Model Context Protocol · in the page specification/draft/basic/transports/streamable-http …d content types. 3. The client **MUST** include the [request metadata headers](#request-metadata) on each POST request. 4. The body of the HTTP POST **MUST** be a single JSON-RPC *request* or *n… Versioning and Compatibility Model Context Protocol · in the page specification/draft/basic/versioning …e required `_meta` fields). HTTP: the request is missing the required headers and is rejected per [server validation](/specification/draft/basic/transports/streamable-http.md#server-validation) with `… Schema Reference Model Context Protocol · in the page specification/draft/schema …ass="tsd-comment tsd-typography"><p>Error code returned when the HTTP headers of a request do not match the corresponding values in the request body, or required headers are missing or malformed.<… Tools Model Context Protocol · in the page specification/draft/server/tools …er`](#x-mcp-header) annotation to expose parameter values as HTTP headers * `outputSchema`: Optional JSON Schema defining expected output structure * Follows the [JSON Schema usage guidelines](/…