McpValidationFilter

Validates Model Context Protocol (MCP) requests:

This feature has Evolving interface stability. It’s subject to change without notice, even in a minor or maintenance release.

Validates the Origin header against a list of allowed origins.
Validates the Accept header content types.
Validates the JSON-RPC format of the payload.
Validates the MCP client message format, excluding the tools schemas.
Rewrites the MCP protocol version in the initialize request to the supported version. PingGateway supports version 2025-06-18.
Adds an McpContext for further processing.
Optionally records metrics for MCP requests.

If your MCP server uses server-sent events (SSE), make sure you enable streaming in PingGateway.

Usage

{
  "name": string,
  "type": "McpValidatorFilter",
  "config": {
    "acceptedOrigins": [ configuration expression<pattern>, … ],
    "metricsEnabled": configuration expression<boolean>
    }
  }
}

Properties

"acceptedOrigins": array of configuration expression<pattern>, required: Pattern or array of patterns matching the accepted origins for MCP requests.

The filter uses this for cross-origin request sharing (CORS) validation of the Origin header.
"metricsEnabled": configuration expression<boolean>, optional: Whether to record metrics for MCP requests.

Default: true

More information

org.forgerock.openig.mcp.McpValidatorFilterHeaplet