[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","mcpconformance","name","mcp-client-conformance","path","src/scenarios/server/http-standard-headers.ts","project",{"_22":50,"_11":12,"_35":51,"_52":-5,"_53":44,"_54":55,"_56":55,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":34,"_64":-5,"_65":-5,"_66":67,"_68":69,"_70":-5,"_71":-5,"_72":-5,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/mcpconformance/mcp-client-conformance/code/src/scenarios/server/http-standard-headers.ts","extension","id","0b87acf8-5171-4e20-8da6-f147a8cc3032","http-standard-headers.ts","fileId","d7695966-ad13-11f1-b337-1607ee4eb77e","parentId","ba69bf07-8a57-469b-9cb9-0369b79d16d1","branchId","fdc11199-683b-41f1-a3c5-d5ac53972f86","branchVersion",80,"latest",true,"createdAt",["D",1789046854039],"version",1,"fileType","script","content","/**\n * HTTP Standard Headers server validation test scenarios (SEP-2243)\n *\n * Tests that servers properly validate the standard MCP request headers:\n * - Reject requests where Mcp-Method header doesn't match the body\n * - Reject requests where Mcp-Name header doesn't match the body\n * - Accept case variations of header names (case-insensitive)\n * - Reject case variations of header values (case-sensitive)\n * - Handle whitespace trimming per HTTP spec\n * - Validate Base64-encoded custom header values\n * - Return 400 Bad Request with error code -32020 (HeaderMismatch)\n *\n * This is a ClientScenario (connects to a server under test and validates\n * its behavior).\n */\n\nimport http from 'node:http';\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport {\n withRequestMeta,\n sendStatelessRequest,\n type RunContext\n} from '../../connection/index.ts';\nimport { HEADER_MISMATCH } from '../../spec-types/draft.ts';\nimport { untestableCheck } from '../untestable.ts';\n\nconst SPEC_REFERENCE = {\n id: 'SEP-2243-Server-Validation',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#server-validation'\n};\n\nconst SPEC_REFERENCE_CASE = {\n id: 'SEP-2243-Case-Sensitivity',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#case-sensitivity'\n};\n\n// OWS handling is an RFC 9110 §5.5 MUST (\"a field parsing implementation MUST\n// exclude such whitespace prior to evaluating the field value\"), not a\n// SEP-2243 requirement. Kept as a check because a server stack that fails it\n// has a real HTTP-layer bug that will manifest as header-mismatch rejections.\nconst SPEC_REFERENCE_RFC9110_OWS = {\n id: 'RFC-9110-5.5-Field-Values',\n url: 'https://www.rfc-editor.org/rfc/rfc9110#section-5.5'\n};\n\nconst SPEC_REFERENCE_BASE64 = {\n id: 'SEP-2243-Value-Encoding',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#value-encoding'\n};\n\nconst SPEC_REFERENCE_CUSTOM = {\n id: 'SEP-2243-Custom-Headers',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#server-behavior-for-custom-headers'\n};\n\nconst HEADER_MISMATCH_ERROR_CODE = HEADER_MISMATCH;\n\n// Coarse, requirement-level check IDs (SEP-2243) for STANDARD-header\n// rejections. Every standard-header rejection case emits this same pair of IDs;\n// the per-case name/description carry the detail of which case was exercised,\n// matching the repo's \"same id, vary status/message\" convention.\nconst REJECT_STATUS_CHECK_ID = 'sep-2243-server-reject-invalid-headers';\nconst REJECT_ERROR_CODE_CHECK_ID = 'sep-2243-server-reject-error-code';\n\n// CUSTOM-header (Mcp-Param-*) rejections map to the param-validation\n// requirements instead. The -32020 error-code half of every custom-header\n// rejection is the \"reject with 400 + JSON-RPC error code -32020 if any\n// validation fails\" requirement.\nconst PARAM_REJECT_ERROR_CODE_CHECK_ID =\n 'sep-2243-server-reject-param-mismatch';\n\n/**\n * Every requirement-level check ID HttpCustomHeaderServerValidationScenario\n * can emit (SEP-2243). When the server under test exposes no x-mcp-header\n * tool the scenario cannot exercise these, but it still emits one SKIPPED row\n * per ID so the traceability manifest sees that a scenario exists for each\n * requirement (the manifest joins on emitted IDs regardless of status).\n */\nexport const CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS = [\n 'sep-2243-server-decode-base64',\n 'sep-2243-server-validate-param-match',\n 'sep-2243-server-reject-invalid-param-chars',\n 'sep-2243-server-reject-param-mismatch'\n] as const;\n\n/**\n * The three Mcp-Name validation cases need a callable tool. They are emitted\n * from two places: as live test cases when the server lists a tool, and as\n * untestable failures (issue #248) when it does not — keep the identities in\n * one table so the two paths cannot drift.\n */\nconst MCP_NAME_CASES = [\n {\n id: REJECT_STATUS_CHECK_ID,\n name: 'ServerRejectsMismatchedNameHeader',\n description:\n 'Server rejects tools/call where Mcp-Name does not match body params.name',\n specRef: SPEC_REFERENCE\n },\n {\n id: 'sep-2243-server-accepts-whitespace-header-value',\n name: 'ServerAcceptsWhitespaceHeaderValue',\n description:\n 'Server MUST accept leading/trailing whitespace in Mcp-Name value (RFC 9110 §5.5: field parsing MUST exclude OWS before evaluating)',\n specRef: SPEC_REFERENCE_RFC9110_OWS\n },\n {\n id: REJECT_STATUS_CHECK_ID,\n name: 'ServerRejectsMissingNameHeader',\n description:\n 'Server MUST reject tools/call with missing Mcp-Name header when body has params.name',\n specRef: SPEC_REFERENCE\n }\n] as const;\n\n/** Emit the Mcp-Name cases as untestable failures naming the cause. */\nfunction untestableMcpNameCases(checks: ConformanceCheck[], reason: string) {\n for (const c of MCP_NAME_CASES) {\n checks.push(\n untestableCheck(c.id, c.name, c.description, reason, [c.specRef])\n );\n }\n}\n\n/**\n * Helper to send a raw HTTP POST request with custom headers.\n * Uses Node.js http.request to preserve exact header casing and values,\n * avoiding normalization that fetch()/Headers may apply.\n */\nasync function sendRawRequest(\n serverUrl: string,\n body: object,\n headers: Record = {}\n): Promise<{ status: number; body: any; headers: http.IncomingHttpHeaders }> {\n const url = new URL(serverUrl);\n const bodyStr = JSON.stringify(body);\n\n return new Promise((resolve, reject) => {\n const req = http.request(\n {\n hostname: url.hostname,\n port: url.port,\n path: url.pathname,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'Content-Length': Buffer.byteLength(bodyStr),\n ...headers\n }\n },\n (res) => {\n res.setEncoding('utf8');\n let data = '';\n res.on('data', (chunk) => {\n data += chunk;\n });\n res.on('end', () => {\n let responseBody: any;\n const contentType = res.headers['content-type'];\n if (contentType?.includes('application/json')) {\n try {\n responseBody = JSON.parse(data);\n } catch {\n responseBody = data;\n }\n } else {\n responseBody = data;\n }\n resolve({\n status: res.statusCode || 0,\n body: responseBody,\n headers: res.headers\n });\n });\n }\n );\n\n req.on('error', reject);\n req.write(bodyStr);\n req.end();\n });\n}\n\n/**\n * Builds two checks for a rejection case: one for the HTTP 400 status, one for\n * the -32020 JSON-RPC error code. Per SEP-2243 §Server Validation, 400 is MUST\n * but -32020 is SHOULD for *standard* headers (and MUST for *custom* headers,\n * §Server Behavior for Custom Headers) — so a server returning 400 with a\n * different error code is compliant for standard headers and must not FAIL.\n *\n * The two emitted check IDs are supplied explicitly by the caller: standard-\n * header callers pass the coarse REJECT_STATUS_CHECK_ID/REJECT_ERROR_CODE_CHECK_ID\n * pair, while custom-header/Base64 callers pass the param-validation\n * requirement that case exercises plus PARAM_REJECT_ERROR_CODE_CHECK_ID. The\n * per-case `name`/`description` distinguish which rejection case was\n * exercised.\n */\nfunction createRejectionChecks(\n statusId: string,\n errorCodeId: string,\n name: string,\n description: string,\n response: { status: number; body: any },\n specRef: { id: string; url: string },\n details: Record,\n opts: { errorCodeSeverity: 'FAILURE' | 'WARNING' }\n): ConformanceCheck[] {\n const fullDetails = {\n ...details,\n responseStatus: response.status,\n responseBody: response.body\n };\n const ts = new Date().toISOString();\n\n const statusOk = response.status === 400;\n const codeOk = response.body?.error?.code === HEADER_MISMATCH_ERROR_CODE;\n\n return [\n {\n id: statusId,\n name,\n description,\n status: statusOk ? 'SUCCESS' : 'FAILURE',\n timestamp: ts,\n errorMessage: statusOk\n ? undefined\n : `Expected HTTP 400, got ${response.status}. Server MUST reject with 400 Bad Request.`,\n specReferences: [specRef],\n details: fullDetails\n },\n {\n id: errorCodeId,\n name: `${name}ErrorCode`,\n description: `${description} — uses JSON-RPC error code -32020 (HeaderMismatch)`,\n status: codeOk ? 'SUCCESS' : opts.errorCodeSeverity,\n timestamp: ts,\n errorMessage: codeOk\n ? undefined\n : `Expected JSON-RPC error code ${HEADER_MISMATCH_ERROR_CODE} (HeaderMismatch), got ${response.body?.error?.code ?? '(missing)'}.`,\n specReferences: [specRef],\n details: fullDetails\n }\n ];\n}\n\nfunction createAcceptanceCheck(\n id: string,\n name: string,\n description: string,\n response: { status: number; body: any },\n specRef: { id: string; url: string },\n details: Record\n): ConformanceCheck {\n const errors: string[] = [];\n if (response.status >= 400) {\n errors.push(\n `Expected successful response, got HTTP ${response.status}. Server MUST accept this request.`\n );\n }\n // A server can return HTTP 200 with a JSON-RPC error in the body. Without\n // this assertion that case would pass as \"accepted\".\n if (\n response.body &&\n typeof response.body === 'object' &&\n 'error' in response.body\n ) {\n errors.push(\n `Expected successful response, but body contains JSON-RPC error ${JSON.stringify(response.body.error)}.`\n );\n }\n return {\n id,\n name,\n description,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [specRef],\n details: {\n ...details,\n responseStatus: response.status,\n responseBody: response.body\n }\n };\n}\n\nexport class HttpHeaderValidationScenario implements ClientScenario {\n name = 'http-header-validation';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test server validation of standard MCP request headers (SEP-2243).\n\n**Server Implementation Requirements:**\n\n**Endpoint**: Streamable HTTP\n\n**Requirements**:\n- Server MUST reject requests where Mcp-Method header doesn't match the body method\n- Server MUST reject requests where Mcp-Name header doesn't match the body params.name/uri\n- Server MUST accept header names case-insensitively\n- Server MUST reject case-mismatched header values (method values are case-sensitive)\n- Server MUST accept extra whitespace around header values (per HTTP spec)\n- Server MUST return HTTP 400 Bad Request for validation failures\n- Server MUST return JSON-RPC error with code -32020 (HeaderMismatch)`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Discover the server's tools with a fully-conformant stateless request\n // (SEP-2575) — that wire protocol has no initialize handshake or sessions.\n const toolsResponse = await sendStatelessRequest(serverUrl, 'tools/list');\n if (!toolsResponse.body?.result) {\n // The server under test could not even answer a conformant tools/list:\n // report a single explicit setup failure instead of misleading\n // per-case results against a broken server.\n const rpcError = toolsResponse.body?.error;\n checks.push({\n id: 'sep-2243-server-standard-setup',\n name: 'HttpHeaderValidationSetup',\n description: 'Setup for header validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n `tools/list discovery failed: HTTP ${toolsResponse.status}` +\n (rpcError\n ? `, JSON-RPC error ${rpcError.code}: ${rpcError.message}`\n : ', no result in response body'),\n specReferences: [SPEC_REFERENCE],\n details: { httpStatus: toolsResponse.status, error: rpcError }\n });\n untestableMcpNameCases(\n checks,\n 'tools/list discovery failed, so the Mcp-Name header-validation cases could not be exercised'\n );\n return checks;\n }\n const toolsResult = toolsResponse.body.result as {\n tools?: Array<{ name: string; inputSchema?: unknown }>;\n };\n\n const baseHeaders: Record = {\n 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION\n };\n\n let idCounter = 100;\n const nextId = () => idCounter++;\n\n // --- Header/Body Mismatch Tests ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMismatchedMethodHeader',\n 'Server rejects requests where Mcp-Method header does not match body method',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'Mcp-Method': 'prompts/list' },\n SPEC_REFERENCE,\n { requestBodyMethod: 'tools/list', mcpMethodHeader: 'prompts/list' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMissingMethodHeader',\n 'Server rejects requests with missing Mcp-Method header',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n {},\n SPEC_REFERENCE,\n { requestBodyMethod: 'tools/list', mcpMethodHeader: '(missing)' }\n );\n\n if (toolsResult.tools && toolsResult.tools.length > 0) {\n const toolName = toolsResult.tools[0].name;\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMismatchedNameHeader',\n 'Server rejects tools/call where Mcp-Name does not match body params.name',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n { 'Mcp-Method': 'tools/call', 'Mcp-Name': 'wrong_tool_name' },\n SPEC_REFERENCE,\n { requestBodyName: toolName, mcpNameHeader: 'wrong_tool_name' }\n );\n\n // --- Whitespace Test ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-accepts-whitespace-header-value',\n 'ServerAcceptsWhitespaceHeaderValue',\n 'Server MUST accept leading/trailing whitespace in Mcp-Name value (RFC 9110 §5.5: field parsing MUST exclude OWS before evaluating)',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n {\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': ` ${toolName} `\n },\n SPEC_REFERENCE_RFC9110_OWS,\n {\n headerValue: ` ${toolName} `,\n bodyValue: toolName,\n reason: 'HTTP spec requires trimming OWS around field values'\n }\n );\n\n // --- Missing Standard Header with Value in Body (Case 47) ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMissingNameHeader',\n 'Server MUST reject tools/call with missing Mcp-Name header when body has params.name',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n { 'Mcp-Method': 'tools/call' },\n SPEC_REFERENCE,\n {\n requestBodyName: toolName,\n mcpNameHeader: '(missing)',\n reason:\n 'Standard header omitted but value present in body → MUST reject'\n }\n );\n } else {\n // No tools to exercise the Mcp-Name dimension: these MUST cases were\n // previously omitted without a trace. Emit untestable failures so\n // the gap is visible (issue #248).\n untestableMcpNameCases(\n checks,\n 'server lists no tools, so the Mcp-Name header-validation cases could not be exercised'\n );\n }\n\n // --- Case Sensitivity Tests ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-header-name-case-insensitive',\n 'ServerAcceptsLowercaseHeaderName',\n 'Server MUST accept lowercase header name (mcp-method)',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'mcp-method': 'tools/list' },\n SPEC_REFERENCE_CASE,\n { headerNameUsed: 'mcp-method' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-header-name-case-insensitive',\n 'ServerAcceptsUppercaseHeaderName',\n 'Server MUST accept uppercase header name (MCP-METHOD)',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'MCP-METHOD': 'tools/list' },\n SPEC_REFERENCE_CASE,\n { headerNameUsed: 'MCP-METHOD' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsCaseMismatchValue',\n 'Server MUST reject uppercase method value (TOOLS/LIST) since values are case-sensitive',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'Mcp-Method': 'TOOLS/LIST' },\n SPEC_REFERENCE_CASE,\n { headerValue: 'TOOLS/LIST', bodyValue: 'tools/list' }\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-standard-setup',\n name: 'HttpHeaderValidationSetup',\n description: 'Setup for header validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to set up tests: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE]\n });\n }\n\n return checks;\n }\n\n private async testCase(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n expectation: 'accept' | 'reject',\n checkId: string,\n checkName: string,\n description: string,\n body: any,\n extraHeaders: Record,\n specRef: { id: string; url: string },\n details: Record\n ): Promise {\n try {\n // Issue #311: every raw request carries the SEP-2575 _meta fields — the\n // header-validation cases only mangle headers, never the body metadata.\n const requestBody = {\n ...body,\n id: body.id === 0 ? nextId() : body.id,\n params: withRequestMeta(body.params)\n };\n const response = await sendRawRequest(serverUrl, requestBody, {\n ...baseHeaders,\n ...extraHeaders\n });\n if (expectation === 'reject') {\n // Standard-header rejection: 400 is MUST, -32020 is SHOULD. All\n // standard-header rejection cases collapse onto the coarse requirement\n // ids; checkId/checkName still distinguish the case via name/details.\n checks.push(\n ...createRejectionChecks(\n REJECT_STATUS_CHECK_ID,\n REJECT_ERROR_CODE_CHECK_ID,\n checkName,\n description,\n response,\n specRef,\n details,\n { errorCodeSeverity: 'WARNING' }\n )\n );\n } else {\n checks.push(\n createAcceptanceCheck(\n checkId,\n checkName,\n description,\n response,\n specRef,\n details\n )\n );\n }\n } catch (error) {\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [specRef]\n });\n }\n }\n}\n\nexport class HttpCustomHeaderServerValidationScenario implements ClientScenario {\n name = 'http-custom-header-server-validation';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test server validation of custom Mcp-Param headers and Base64 encoding (SEP-2243).\n\n**Server Implementation Requirements:**\n\n**Endpoint**: Streamable HTTP with at least one tool using \\`x-mcp-header\\`\n\n**Requirements**:\n- Server MUST validate Base64-encoded header values\n- Server MUST reject requests with invalid Base64 padding or characters\n- Server MUST treat values without =?base64?...?= wrapper as literal\n- Server MUST reject requests where custom header is omitted but value is in body`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Discover the server's tools with a fully-conformant stateless request\n // (SEP-2575) — that wire protocol has no initialize handshake or sessions.\n const toolsResponse = await sendStatelessRequest(serverUrl, 'tools/list');\n if (!toolsResponse.body?.result) {\n // The server under test could not even answer a conformant tools/list:\n // report a single explicit setup failure (and backfill the declared\n // checks, mirroring the catch path) instead of pretending the\n // requirements are not applicable to a broken server.\n const rpcError = toolsResponse.body?.error;\n checks.push({\n id: 'sep-2243-server-custom-setup',\n name: 'HttpCustomHeaderServerValidationSetup',\n description: 'Setup for custom header server validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n `tools/list discovery failed: HTTP ${toolsResponse.status}` +\n (rpcError\n ? `, JSON-RPC error ${rpcError.code}: ${rpcError.message}`\n : ', no result in response body'),\n specReferences: [SPEC_REFERENCE_CUSTOM],\n details: { httpStatus: toolsResponse.status, error: rpcError }\n });\n this.failDeclaredChecks(checks);\n return checks;\n }\n const toolsResult = toolsResponse.body.result as {\n tools?: Array<{ name: string; inputSchema?: unknown }>;\n };\n\n // Find a tool with x-mcp-header annotations\n const xMcpTool = toolsResult.tools?.find((tool) => {\n const schema = tool.inputSchema as any;\n if (!schema?.properties) return false;\n return Object.values(schema.properties).some(\n (prop: any) => prop['x-mcp-header'] !== undefined\n );\n });\n\n if (!xMcpTool) {\n checks.push(\n untestableCheck(\n 'sep-2243-server-no-xmcp-tool',\n 'HttpCustomHeaderServerNoTool',\n 'Server has no tools with x-mcp-header annotations to test',\n 'server exposes no tool with x-mcp-header annotations, so none of the custom-header validation requirements could be exercised',\n [SPEC_REFERENCE_CUSTOM]\n )\n );\n this.untestableDeclaredChecks(\n checks,\n 'server exposes no tool with x-mcp-header annotations'\n );\n return checks;\n }\n\n const baseHeaders: Record = {\n 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION\n };\n\n // Find the first x-mcp-header annotated STRING property\n // that is callable with minimal arguments to avoid schema validation failures\n const schema = xMcpTool.inputSchema as any;\n const annotatedEntry = Object.entries(schema.properties).find(\n ([, def]: [string, any]) =>\n def['x-mcp-header'] !== undefined && (def as any).type === 'string'\n );\n if (!annotatedEntry) {\n checks.push(\n untestableCheck(\n 'sep-2243-server-no-string-param',\n 'HttpCustomHeaderServerNoStringParam',\n 'Server has no string-typed x-mcp-header parameter to test',\n 'server exposes no string-typed x-mcp-header parameter, so the custom-header validation requirements could not be exercised',\n [SPEC_REFERENCE_CUSTOM]\n )\n );\n this.untestableDeclaredChecks(\n checks,\n 'server exposes no string-typed x-mcp-header parameter'\n );\n return checks;\n }\n const [paramName, paramDef] = annotatedEntry as [string, any];\n const headerSuffix = paramDef['x-mcp-header'];\n\n // Build default arguments for all required params to avoid schema validation errors.\n // These go in the JSON body, so number/boolean must be the real types —\n // sending '0' or 'false' as strings makes the server reject on JSON-schema\n // grounds and the header-validation checks below would false-pass on that 400.\n const requiredParams: string[] = schema.required || [];\n const defaultArgs: Record = {};\n const defaultHeaders: Record = {};\n for (const rp of requiredParams) {\n if (rp !== paramName) {\n const rpDef = schema.properties[rp];\n const rpType = rpDef?.type || 'string';\n if (rpType === 'number' || rpType === 'integer') {\n defaultArgs[rp] = 0;\n } else if (rpType === 'boolean') {\n defaultArgs[rp] = false;\n } else {\n defaultArgs[rp] = 'test-default';\n }\n // If this required param also has x-mcp-header, include its header too\n if (rpDef?.['x-mcp-header']) {\n defaultHeaders[`Mcp-Param-${rpDef['x-mcp-header']}`] = String(\n defaultArgs[rp]\n );\n }\n }\n }\n\n let idCounter = 200;\n const nextId = () => idCounter++;\n\n // --- Base64 Decoding Tests ---\n\n const validBase64Value = Buffer.from('Hello').toString('base64');\n\n // Valid Base64 - server decodes and validates\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-decode-base64',\n 'ServerAcceptsValidBase64',\n 'Server decodes valid Base64 header value and validates against body',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n `=?base64?${validBase64Value}?=`,\n defaultArgs,\n defaultHeaders\n );\n\n // Invalid Base64 padding — FAILURE per the SEP-2243 conformance-test-case\n // table, which is the approved source of truth for these cases. The spec\n // body says only \"MUST decode them accordingly\", but the table specifies\n // strict rejection. SDKs whose stdlib decoders are lenient (Node\n // Buffer.from, browser atob) will need to validate before decoding; if\n // that proves burdensome we'll revisit.\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n 'sep-2243-server-reject-invalid-param-chars',\n 'ServerRejectsInvalidBase64Padding',\n 'Server MUST reject Mcp-Param header with invalid Base64 padding (per SEP-2243 test-case table)',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n '=?base64?SGVsbG8?=',\n defaultArgs,\n defaultHeaders\n );\n\n // Invalid Base64 characters — FAILURE for the same reason as padding.\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n 'sep-2243-server-reject-invalid-param-chars',\n 'ServerRejectsInvalidBase64Chars',\n 'Server MUST reject Mcp-Param header with non-alphabet Base64 characters (per SEP-2243 test-case table)',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n '=?base64?SGVs!!!bG8=?=',\n defaultArgs,\n defaultHeaders\n );\n\n // Missing prefix - server treats as literal value\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-validate-param-match',\n 'ServerLiteralMissingBase64Prefix',\n 'Server treats value without =?base64? prefix as literal (not Base64)',\n xMcpTool.name,\n paramName,\n validBase64Value,\n headerSuffix,\n validBase64Value,\n defaultArgs,\n defaultHeaders\n );\n\n // Missing suffix - server treats as literal value\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-validate-param-match',\n 'ServerLiteralMissingBase64Suffix',\n 'Server treats value without ?= suffix as literal (not Base64)',\n xMcpTool.name,\n paramName,\n `=?base64?${validBase64Value}`,\n headerSuffix,\n `=?base64?${validBase64Value}`,\n defaultArgs,\n defaultHeaders\n );\n\n // --- Missing Custom Header with Value in Body ---\n\n await this.testMissingCustomHeader(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n xMcpTool.name,\n paramName,\n headerSuffix,\n defaultArgs,\n defaultHeaders\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-custom-setup',\n name: 'HttpCustomHeaderServerValidationSetup',\n description: 'Setup for custom header server validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n\n // Declared-but-unemitted -> FAILURE. Reached only when setup threw partway\n // through (the gate-out paths emit untestable FAILURE rows and the happy path emits\n // every declared ID).\n this.failDeclaredChecks(checks);\n\n return checks;\n }\n\n /**\n * Backfill every declared-but-unemitted check ID as FAILURE when setup\n * failed before the cases could run, keeping the emitted ID set stable.\n */\n private failDeclaredChecks(checks: ConformanceCheck[]): void {\n for (const id of CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS) {\n if (checks.some((c) => c.id === id)) continue;\n checks.push({\n id,\n name: 'NotObserved',\n description: `Declared check ${id} was never emitted`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Check was not observed: custom-header validation setup failed before this case ran.',\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n }\n\n /**\n * Emit one untestable FAILURE row per declared requirement check when the\n * scenario cannot run against this server (no x-mcp-header tool). These\n * are MUST requirements, so a missing fixture must read red, not green\n * (issue #248); the IDs still reach checks.json so the traceability\n * manifest records that a scenario exists for each requirement.\n */\n private untestableDeclaredChecks(\n checks: ConformanceCheck[],\n reason: string\n ): void {\n for (const id of CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS) {\n if (checks.some((c) => c.id === id)) continue;\n checks.push(\n untestableCheck(\n id,\n 'NotTestable',\n `Declared check ${id} is not testable against this server`,\n reason,\n [SPEC_REFERENCE_CUSTOM]\n )\n );\n }\n }\n\n private async testBase64Case(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n expectation: 'accept' | 'reject',\n checkId: string,\n checkName: string,\n description: string,\n toolName: string,\n paramName: string,\n bodyValue: string,\n headerSuffix: string,\n headerValue: string,\n defaultArgs: Record,\n defaultHeaders: Record\n ): Promise {\n try {\n const response = await sendRawRequest(\n serverUrl,\n {\n jsonrpc: '2.0',\n id: nextId(),\n method: 'tools/call',\n // Issue #311: the body always carries the SEP-2575 _meta fields —\n // these cases only vary the Mcp-Param header value.\n params: withRequestMeta({\n name: toolName,\n arguments: { ...defaultArgs, [paramName]: bodyValue }\n })\n },\n {\n ...baseHeaders,\n ...defaultHeaders,\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': toolName,\n [`Mcp-Param-${headerSuffix}`]: headerValue\n }\n );\n\n const details = {\n toolName,\n paramName,\n bodyValue,\n headerSuffix,\n headerValue\n };\n\n if (expectation === 'accept') {\n checks.push(\n createAcceptanceCheck(\n checkId,\n checkName,\n description,\n response,\n SPEC_REFERENCE_BASE64,\n details\n )\n );\n } else {\n // Custom-header rejection: both 400 and -32020 are MUST per\n // §Server Behavior for Custom Headers. The status half maps to the\n // param-validation requirement this case exercises (checkId); the\n // error-code half is the \"400 + -32020 if any validation fails\"\n // requirement.\n checks.push(\n ...createRejectionChecks(\n checkId,\n PARAM_REJECT_ERROR_CODE_CHECK_ID,\n checkName,\n description,\n response,\n SPEC_REFERENCE_BASE64,\n details,\n { errorCodeSeverity: 'FAILURE' }\n )\n );\n }\n } catch (error) {\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_BASE64]\n });\n }\n }\n\n private async testMissingCustomHeader(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n toolName: string,\n paramName: string,\n headerSuffix: string,\n defaultArgs: Record,\n defaultHeaders: Record\n ): Promise {\n try {\n // Send tools/call with value in body but NO Mcp-Param header\n const response = await sendRawRequest(\n serverUrl,\n {\n jsonrpc: '2.0',\n id: nextId(),\n method: 'tools/call',\n // Issue #311: the body always carries the SEP-2575 _meta fields —\n // this case only omits the Mcp-Param header.\n params: withRequestMeta({\n name: toolName,\n arguments: { ...defaultArgs, [paramName]: 'test-value' }\n })\n },\n {\n ...baseHeaders,\n ...defaultHeaders,\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': toolName\n // Deliberately omit Mcp-Param-{headerSuffix} header\n }\n );\n\n // Custom-header rejection: both 400 and -32020 are MUST. A header\n // omitted while the body carries a value is a header/body mismatch, so\n // the status half maps to the validate-param-match requirement.\n checks.push(\n ...createRejectionChecks(\n 'sep-2243-server-validate-param-match',\n PARAM_REJECT_ERROR_CODE_CHECK_ID,\n 'ServerRejectsMissingCustomHeader',\n 'Server MUST reject request where custom header is omitted but value is present in body',\n response,\n SPEC_REFERENCE_CUSTOM,\n {\n toolName,\n paramName,\n bodyValue: 'test-value',\n expectedHeader: `Mcp-Param-${headerSuffix}`,\n mcpParamHeader: '(missing)'\n },\n { errorCodeSeverity: 'FAILURE' }\n )\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-validate-param-match',\n name: 'ServerRejectsMissingCustomHeader',\n description:\n 'Server MUST reject request where custom header is omitted but value is present in body',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n }\n}\n","deleted",false,"label",[47,48,49,24],"src","scenarios","server","7dcb6042-d92f-40c5-9cc8-0f661f96e58b",["D",1789043604380],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","e6dd13e2-ad13-11f1-a612-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07c12-b73a-76de-b96a-421ce8582af6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":-5},"org",{"_9":10,"_100":101,"_102":-5,"_59":-5,"_103":104,"_105":44},"branch",{"_37":90,"_11":91,"_22":30,"_92":50,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":12,"_99":10},"isOwned",396,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","MCP Conformance","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_83":-5,"_140":141,"_142":143,"_144":145,"_146":44,"_147":44,"_148":44,"_149":34,"_150":-5,"_151":-7,"_152":-7,"_153":67,"_154":44,"_155":44,"_156":-5,"_157":44,"_158":44,"_159":44,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":91,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]