Module version 

Protocol version, and the guard that decides whether the mirrored headers may be trusted at all.

The mirrored headers (Mcp-Method, Mcp-Name, Mcp-Param-*) are only usable because 2026-07-28 obliges the origin server to reject any request whose headers disagree with its body, with -32020 HeaderMismatch. On an earlier revision no such obligation exists, so the client controls those values. The specification gives intermediaries this requirement:

Intermediaries that enforce policy based on mirrored headers (e.g., routing or rate-limiting by tenant) SHOULD verify that the MCP-Protocol-Version header indicates a version that requires header-body validation. If the version is older or the header is absent, the intermediary SHOULD reject the request rather than trusting unvalidated header values.

Note “reject”, not “fall back to parsing the body”. A meter that quietly degrades to body parsing on a legacy request is metering a request the origin will never validate, and a client that wants to be billed for a cheap tool while calling an expensive one only has to claim an old protocol version.

Structs

ProtocolVersion

A dated MCP protocol version, e.g. 2026-07-28.

Enums

HeaderTrust

The verdict on whether mirrored headers may drive billing for this request.

TrustFailure

Why mirrored headers could not be trusted.

Constants

HEADER_VALIDATION_SINCE

The revision from which header/body validation is mandatory, and therefore from which mirrored headers can be trusted.

Functions

assess

Decide whether this request’s mirrored headers may drive billing.

validate_header

Validate a protocol-version header without allocating on the trusted path.