A tool developer adds x-mcp-header to a tool's apiKey parameter so that a load balancer can route requests on it. What does the tools specification say about this choice?
Select an answer to reveal the explanation.
Short Explanation
Headers are the outside of the envelope — every load balancer, proxy and log on the way gets to read them. An API key written there is a postcard, not a letter. You keep secrets in the body and mirror only harmless routing values.
Full Explanation
The x-mcp-header extension lets a server designate tool parameters to be mirrored into Mcp-Param-{Name} HTTP headers on Streamable HTTP so that load balancers, proxies and web application firewalls can route on them without parsing the JSON body. The tools specification warns that server developers SHOULD NOT mark sensitive parameters such as passwords, API keys, tokens or personal data with x-mcp-header, because header values are visible to network intermediaries and commonly land in access logs. Mirrored headers are not encrypted separately from the body; they travel with the same transport protection and are deliberately readable by intermediaries, which is their purpose. Mirroring is opt-in per parameter, not required for every string, and it is limited to primitive, statically reachable properties. Clients do not strip these headers; conforming Streamable HTTP clients MUST add them, and servers MUST validate them against the body and reject mismatches with HTTP 400 and HeaderMismatch error -32020. Exam caveat: clients on stdio MAY ignore x-mcp-header entirely, since there is no header layer. Operational check: review every tool inputSchema for x-mcp-header annotations and confirm none is attached to a credential or personal-data parameter, then check that gateway logs contain no secret values.