CONF-007: Origin header is validated on Streamable HTTP¶
| Severity | Applies to | Spec section |
|---|---|---|
| error | both eras, http | 2026-07-28/basic/transports/streamable-http#security--endpoint |
Sends a valid request with Origin: https://mcpprobe-rebind.invalid. Servers MUST validate Origin to prevent DNS rebinding and MUST answer an invalid Origin with HTTP 403; the rule is the same in 2025-11-25 (https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#security-warning). On servers that speak both eras it runs twice: once with modern requests, and once inside a legacy initialize session as
From the command line: mcpprobe checks explain CONF-007. To leave it out of a run, add "CONF-007" to [checks] disable in mcpprobe.toml; to change how much it counts, use severity_overrides.