Fix: an Mcp-Method header disagreeing with the body method draws -32020

Web-audit fix skill for the mcp-modern-header-mismatch check (MCP, SHOULD).

Goal

Validate the SEP-2243 header mirror between Mcp-Method and the body method.

Fix

Reject a request whose Mcp-Method header names a different method than the JSON-RPC body with error.code: -32020 (header mismatch). The SEP-2243 headers exist so infrastructure can route without parsing bodies; a disagreeing pair means the routing layer and the handler would act on different methods, so it must be refused rather than silently resolved in either direction.

Resources

• MCP lifecycle (2026-07-28)

Copy-paste prompt

Paste this into your coding agent. Your audit adds what it observed for this check:

Verify

Re-run the audit at https://anc.dev/audit or call the audit_website MCP tool; the mcp-modern-header-mismatch check should report pass.