Arm the Mcp-Param server-validation conformance checks with an x-mcp-header fixture tool

All five SEP-2243 Mcp-Param-* server-validation checks in
http-custom-header-server-validation skipped silently because no
everything-server tool carried an x-mcp-header annotation — the scenario
printed a green 0-passed/0-failed in every leg that selected it.

Add a test_x_mcp_header tool whose region parameter carries the
annotation via json_schema_extra (mirroring the typescript-sdk fixture).
The checks now execute: the accept-path checks pass and the reject-path
checks fail because server-side Mcp-Param validation is not implemented
yet, so the scenario is baselined in both expected-failures files. The
stale-entry rule forces the entries out when validation lands.

Author: maxisbey

.github/actions/conformance/expected-failures.2026-07-28.yml

@@ -22,4 +22,7 @@
 
 client: []
 
-server: []
+server:
+  # SEP-2243 Mcp-Param-* server-side validation is not implemented yet; see
+  # the matching entry in expected-failures.yml for the full rationale.
+  - http-custom-header-server-validation

.github/actions/conformance/expected-failures.yml

@@ -13,6 +13,13 @@
 client: []
 
 server:
+  # SEP-2243 Mcp-Param-* server-side validation is not implemented yet. The
+  # everything-server's `test_x_mcp_header` tool arms these checks (without an
+  # x-mcp-header-annotated tool the harness skips all of them silently); the
+  # accept-path checks pass, the reject-path checks fail until the server
+  # validates Mcp-Param headers against body params. Read by the draft leg and
+  # the bare `--suite all` leg; the 2026-07-28 leg carries its own entry.
+  - http-custom-header-server-validation
   # SEP-2663 (io.modelcontextprotocol/tasks): the SDK does not implement the
   # tasks extension yet. These extension-tagged scenarios are selected only by
   # the bare `--suite all` leg — extension scenarios never match a

examples/servers/everything-server/mcp_everything_server/server.py

@@ -11,7 +11,7 @@
 import hmac
 import json
 import logging
-from typing import Any
+from typing import Annotated, Any
 
 import click
 from mcp.server import ServerRequestContext
@@ -327,6 +327,24 @@ def test_error_handling() -> str:
     raise RuntimeError("This tool intentionally returns an error for testing")
 
 
+@mcp.tool()
+def test_x_mcp_header(
+    region: Annotated[
+        str,
+        Field(
+            description="Mirrored into the Mcp-Param-Region header",
+            json_schema_extra={"x-mcp-header": "Region"},
+        ),
+    ] = "<none>",
+) -> str:
+    """Tests SEP-2243 Mcp-Param-* server-side validation.
+
+    Arms the http-custom-header-server-validation conformance scenario, which
+    skips when no tool with an `x-mcp-header` annotation is found.
+    """
+    return f"region={region}"
+
+
 @mcp.tool()
 async def test_missing_capability(ctx: Context) -> str:
     """Tests that a handler-raised MISSING_REQUIRED_CLIENT_CAPABILITY surfaces as a top-level JSON-RPC error.