A developer is writing a minimal Streamable HTTP client for revision 2026-07-28. Besides the usual Content-Type and Accept headers, which MCP-specific headers must every tools/call POST carry?
Select an answer to reveal the explanation.
Short Explanation
Think of it as the shipping label on every parcel: protocol version, what kind of request it is, and which tool it's for. You put those three headers on so gateways can route without opening the box. The trap is reaching for the old session and replay headers that this revision dropped.
Full Explanation
Every POST to the MCP endpoint must include MCP-Protocol-Version, whose value must match io.modelcontextprotocol/protocolVersion in the body's _meta. The standard request headers add Mcp-Method, mirroring the JSON-RPC method and required for all requests, and Mcp-Name, mirroring params.name or params.uri and required for tools/call, resources/read and prompts/get. A tools/call POST therefore carries all three, with Mcp-Name set to the tool's name, Base64-encoded in the sentinel format if it is not header-safe. Servers reject requests that are missing a required header or whose headers disagree with the body, using 400 and HeaderMismatch. Mcp-Session-Id belonged to the protocol-level sessions removed in this revision; a modern server ignores it and never mints one. Last-Event-ID supported SSE resumability, which was also removed, so streams cannot be replayed. Mcp-Param headers are not sent for every argument; they appear only for parameters the server marked with x-mcp-header in the tool's inputSchema, and only when a value is present. Exam caveat: on HTTP, a bearer token in the Authorization header is also sent when the server requires authorization, but that comes from the authorization specification, not these transport headers. Operational check: capture a tools/call request and confirm all three headers are present and match the body.