---
title: McpValidationFilter
description: Validates Model Context Protocol (MCP) requests:
component: pinggateway
version: 2026
page_id: pinggateway:reference:McpValidationFilter
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/McpValidationFilter.html
revdate: 2026-03-12T10:00:00Z
section_ids:
  usage: Usage
  properties: Properties
  more_information: More information
---

# McpValidationFilter

Validates [Model Context Protocol (MCP)](https://modelcontextprotocol.io/docs/getting-started/intro) requests:

|   |                                                                                                                                                                                                                             |
| - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | This feature has [Evolving](https://docs.pingidentity.com/pinggateway/release-notes/stability.html#interface-stability) interface stability. It's subject to change without notice, even in a minor or maintenance release. |

* Validates the `Origin` header against a list of allowed origins.

* Validates the `Accept` header content types.

* Validates the JSON-RPC format of the payload.

* Validates the MCP client message format, excluding the `tools` schemas.

* Rewrites the MCP protocol version in the `initialize` request to the supported version. PingGateway supports version `2025-06-18`.

* Adds an [McpContext](McpContext.html) for further processing.

* Optionally records metrics for MCP requests.

|   |                                                                                                                                                                                                                                                                     |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | If your MCP server uses [server-sent events (SSE)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events), make sure you [enable streaming](AdminHttpApplication.html#AdminHttpApplication-streamingEnabled) in PingGateway. |

## Usage

```none
{
  "name": string,
  "type": "McpValidationFilter",
  "config": {
    "acceptedOrigins": [ configuration expression<pattern>, …​ ],
    "metricsEnabled": configuration expression<boolean>
    }
  }
}
```

## Properties

* `"acceptedOrigins"`: *array of configuration expression<[pattern](preface.html#definition-pattern)>, required*

  Pattern or array of patterns matching the accepted origins for MCP requests.

  The filter uses this for cross-origin request sharing (CORS) validation of the `Origin` header.

* `"metricsEnabled"`: *configuration expression<[boolean](preface.html#definition-boolean)>, optional*

  Whether to record metrics for MCP requests.

  Default: `true`

## More information

[org.forgerock.openig.mcp.McpValidationFilterHeaplet](../_attachments/apidocs/org/forgerock/openig/mcp/McpValidationFilterHeaplet.html)