Source note · Model Context Protocol transports compared
In Streamable HTTP under MCP revision 2026-07-28, servers MUST validate the Origin header on all incoming connections and MUST respond with HTTP 403 Forbidden when an Origin header is present and invalid.
Checked 2026-09-30
- Vendor
- Model Context Protocol project
- Product
- MCP specification
- Subsystem
- Streamable HTTP transport security
- Deployment
- remote-http
- Region
- not restricted
- Release range
- MCP revisions 2025-11-25 and 2026-07-28
- Checked
- 2026-09-30
Sources
- Model Context Protocol specification 2026-07-28, Streamable HTTP — Model Context Protocol project · tier 1 standards and regulators · section Security & Endpoint, item 1
Cite this note
APA
WarmTransfer. (2026, September 30). Model Context Protocol transports compared: source note mcp-transport-differences-http-origin-validation. WarmTransfer. https://warmtransfer.net/knowledge/claims/mcp-transport-differences-http-origin-validation
BibTeX
@misc{warmtransfer-claim-mcp-transport-differences-http-origin-validation,
title = {Model Context Protocol transports compared: source note mcp-transport-differences-http-origin-validation},
author = {{WarmTransfer}},
year = {2026},
url = {https://warmtransfer.net/knowledge/claims/mcp-transport-differences-http-origin-validation},
note = {Source note mcp-transport-differences-http-origin-validation, checked 2026-09-30}
}