local M = {} function M.check(header, body) if not header or not body then return false, -32600, "Invalid Request" end -- Rule 1: header['mcp-protocol-version'] missing if not header['mcp-protocol-version'] then return false, -32020, 'Missing required header: MCP-Protocol-Version' end -- Rule 2: header['mcp-method'] missing if not header['mcp-method'] then return false, -32020, 'Missing required header: Mcp-Method' end -- Rule 2: header['mcp-method'] ~= body.method if header['mcp-method'] ~= body.method then return false, -32020, 'Mcp-Method header does not match body' end -- Rule 3: Mcp-Name header required for tools/call, resources/read, prompts/get local method = body.method local params = body.params or {} if method == 'tools/call' or method == 'prompts/get' then if not header['mcp-name'] or header['mcp-name'] ~= params.name then return false, -32020, 'Mcp-Name header does not match body' end elseif method == 'resources/read' then if not header['mcp-name'] or header['mcp-name'] ~= params.uri then return false, -32020, 'Mcp-Name header does not match body' end end -- Rule 4: _meta required fields (located under params._meta) local meta = (body.params or {})._meta or {} if not meta['io.modelcontextprotocol/protocolVersion'] then return false, -32602, 'Missing required _meta field: io.modelcontextprotocol/protocolVersion' end if not meta['io.modelcontextprotocol/clientCapabilities'] then return false, -32602, 'Missing required _meta field: io.modelcontextprotocol/clientCapabilities' end -- Rule 5: header['mcp-protocol-version'] ~= meta['io.modelcontextprotocol/protocolVersion'] if header['mcp-protocol-version'] ~= meta['io.modelcontextprotocol/protocolVersion'] then return false, -32020, 'Header MCP-Protocol-Version does not match _meta protocolVersion' end -- Success return true, nil, nil end return M