Expose an MCP tool parameter as an HTTP header using the x-mcp-header schema annotation

Documented steps

1. Read the x-mcp-header section of https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http (SEP-2243). The mechanism lets a tool parameter be mirrored into an HTTP header so intermediaries can route or authorize on it without parsing the body.
2. In the tool's inputSchema, annotate the chosen property with a string 'x-mcp-header' value, e.g. {'region': {'type':'string','x-mcp-header':'Region'}}.
3. The client then sends the value as 'Mcp-Param-{Name}', e.g. 'Mcp-Param-Region: us-west1'.
4. Keep the annotation value legal: non-empty, matching HTTP field-name token syntax (1*tchar, RFC 9110 5.1), containing no control characters including CR/LF, and case-insensitively unique across all x-mcp-header values in that inputSchema.
5. Annotate only primitive-typed properties: integer, string or boolean. The 'number' type is NOT permitted. Integers must stay inside the JavaScript safe-integer range (-2^53+1 .. 2^53-1).
6. Annotate only properties statically reachable from the schema root through a chain of 'properties' keys. The chain MUST NOT pass through items, oneOf/anyOf/allOf/not, if/then/else, or $ref. Nested objects are fine if every hop is a properties key.
7. Client side: read the instance value at that exact property path; if the value is absent, omit the header entirely.
8. Client side: encode values that are not plain printable ASCII (or that have leading/trailing whitespace, or that themselves look like the sentinel) as 'Mcp-Param-{Name}: =?base64?{Base64EncodedValue}?=' using the lowercase, case-sensitive markers. The same rule applies to Mcp-Name.
9. Server side: decode the header, then validate it matches the corresponding body value. On mismatch return HTTP 400 with JSON-RPC -32020 HeaderMismatch. Reject invalid characters in a recognized header with 400.
10. Verify with a proxy in the path: confirm the header arrives intact, that a deliberately mismatched header is rejected 400/-32020, and that omitting the optional parameter omits the header.