A gateway routes Streamable HTTP requests by the Mcp-Name header. A request arrives with Mcp-Name: get_weather, but the JSON-RPC body's params.name is delete_records. How must the MCP server that processes the body respond?
Select an answer to reveal the explanation.
Short Explanation
Picture a parcel labeled "books" on the outside with a chainsaw inside — the warehouse routed it as books. If you're the server, you refuse the mismatch outright with 400 and -32020. The trap is picking either value as "the real one."
Full Explanation
Streamable HTTP mirrors selected body fields into headers so intermediaries can route and inspect requests without parsing JSON: Mcp-Method mirrors method, and Mcp-Name mirrors params.name or params.uri for tools/call, resources/read and prompts/get. Because different components may rely on different sources of truth, servers that process the body must reject any request where header values do not match the body, returning HTTP 400 Bad Request with JSON-RPC error -32020, HeaderMismatch. The scenario shows why: the gateway applied get_weather policy while the body asks to delete records. Executing the body's tool ignores the mandatory validation and lets an attacker slip a dangerous call past routing or rate-limiting rules. Executing the header's tool is equally wrong, since the server executes what the body says and must not quietly substitute a different operation. A 404 with -32601 is reserved for an RPC method the server does not implement, and tools/call is implemented here. Exam caveat: servers must decode Base64-sentinel header values before comparing them, so an encoded name that decodes to the body value is not a mismatch. Operational check: send a test request with deliberately mismatched Mcp-Name and body name and confirm a 400 response carrying error code -32020.