---
title: McpValidationFilter
description: Configure McpValidationFilter to validate Model Context Protocol (MCP) requests in PingGateway, including origin, headers, JSON-RPC payload, and metrics
component: pinggateway
version: 2025.11
page_id: pinggateway:reference:McpValidationFilter
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/McpValidationFilter.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-09-28T10:32:53Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/McpValidationFilter.html
section_ids:
  usage: Usage
  properties: Properties
  more_information: More information
---

# McpValidationFilter

Validates [Model Context Protocol (MCP)](https://modelcontextprotocol.io/docs/getting-started/intro) requests:

|   |                                                                                                                                                                                                                             |
| - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | This feature has [Evolving](https://docs.pingidentity.com/pinggateway/release-notes/stability.html#interface-stability) interface stability. It's subject to change without notice, even in a minor or maintenance release. |

* Validates the `Origin` header against a list of allowed origins.

* Validates the `Accept` header content types.

* Validates the JSON-RPC format of the payload.

* Validates the MCP client message format, excluding the `tools` schemas.

* Rewrites the MCP protocol version in the `initialize` request to the supported version. PingGateway supports version `2025-06-18`.

* Adds an [McpContext](McpContext.html) for further processing.

* Optionally records metrics for MCP requests.

|   |                                                                                                                                                                                                                                                                     |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | If your MCP server uses [server-sent events (SSE)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events), make sure you [enable streaming](AdminHttpApplication.html#AdminHttpApplication-streamingEnabled) in PingGateway. |

## Usage

```none
{
  "name": string,
  "type": "McpValidatorFilter",
  "config": {
    "acceptedOrigins": [ configuration expression<pattern>, …​ ],
    "metricsEnabled": configuration expression<boolean>,
    "maxMetricParamValues": configuration expression<number>
    }
  }
}
```

## Properties

* `"acceptedOrigins"`: *array of configuration expression<[pattern](preface.html#definition-pattern)>, required*

  Pattern or array of patterns matching the accepted origins for MCP requests.

  The filter uses this for cross-origin request sharing (CORS) validation of the `Origin` header.

  The pattern isn't anchored. Use an anchored pattern in your settings, such as `"acceptedOrigins": "^https://example.com$"`. Don't use a pattern like `example.com` alone, because that matches *any* origin containing `example.com`, including `http://malicious-example.com`.

* `"metricsEnabled"`: *configuration expression<[boolean](preface.html#definition-boolean)>, optional*

  Whether to record metrics for MCP requests.

  Default: `true`

* `"maxMetricParamValues"`: *configuration expression<[number](preface.html#definition-number)>, optional*

  The maximum number of distinct tool, prompt, and resource names tracked in MCP metrics per method. Beyond this value, PingGateway groups the metrics into an "other" category.

  Default: 1000

## More information

[org.forgerock.openig.mcp.McpValidatorFilterHeaplet](../_attachments/apidocs/org/forgerock/openig/mcp/McpValidationFilterHeaplet.html)