Skip to content

v0.8.45 — MCP 2026-07-28 SEP-2243 header-integrity preset

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 08 Jul 17:33
v0.8.45
2e0dc45
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MCP 2026-07-28 SEP-2243 header-integrity preset

Contract-level conformance for the MCP 2026-07-28 SEP-2243 routing headers. The Streamable HTTP transport now requires Mcp-Method and Mcp-Name headers "so load balancers, gateways, and rate-limiters can route on the operation without inspecting the body", and mandates that "Servers reject requests where the headers and body disagree" (2026-07-28 release candidate). Because the edge routes / rate-limits / authorizes on those headers while the server executes the body, a header/body mismatch is a confused-deputy vector.

Added

  • agent_airlock.mcp_spec.header_integrity — validate_header_body_integrity(request) + HeaderBodyMismatchError (carries a structured audit_event mapping).
  • mcp_spec_2026_07_header_integrity_defaults() / the MCP_SPEC_2026_07_HEADER_INTEGRITY constant expose check_request(request): both routing headers must be present and Mcp-Method / Mcp-Name must match the body's method / operation name. Fail-closed (deny) on any missing header or disagreement. Auto-registered in list_active().
  • Composed from existing primitives (stdlib mapping traversal) — no new engine, mirroring the SEP-2468 / SEP-2567 preset shape. Opt-in, Pydantic-only, zero-dep core. SEP-2243 is a spec id, not a CVE (pinned by test).

Fixed

  • policy_compiler/compiler.py: canonical is not None threshold narrowing, resolving a mypy-2.2.0 unused-ignore drift that failed mypy src/ on every PR (runtime behavior unchanged).

Full test suite: 3,378 tests · 85.30% coverage.

Assets 2
Loading