events/* requests must carry and validate Mcp-Name (SEP-3415 @ 2ec39b9c) #1567

SEP-3415 moved after our last re-quote. Head 2ec39b9c (2026-10-16, "require Mcp-Name on events requests over Streamable HTTP") adds a section Streamable HTTP: Routing Headers and drops Open Question 8:

When events/poll, events/stream, events/subscribe or events/unsubscribe is sent over the Streamable HTTP transport, the client MUST set the Mcp-Name header (defined by SEP-2243) to the value of params.name […]

• An event name that cannot be safely represented as a plain ASCII header value MUST be carried in the Base64 sentinel format.
• […] A request whose Mcp-Name header is missing, or does not match params.name, is rejected with HTTP status 400 Bad Request and HeaderMismatch (-32020).

events/list has no params.name and carries no Mcp-Name header.

mcpkit does neither half today:

• Client: core.DeriveMcpName (core/sep2243.go) covers tools/call, prompts/get, resources/read and tasks/*. An events/* request goes out with Mcp-Method only.
• Server: extractRoutingName in server/header_validation.go validates Mcp-Name for tools/call and resources/read only, so an events/* request with a missing or wrong header is accepted.

Found via the rmcp implementers' comment on conformance PR 521 (modelcontextprotocol/conformance#521 (comment)), which also mentions a base64 interop issue with mcpkit. Not yet known whether that is this sentinel encoding.

Work

• DeriveMcpName: map the four events/* methods to params.name, with the Base64 sentinel for non-ASCII names (reuse whatever tools/call uses).
• extractRoutingName: the same four methods, so a missing or mismatched header gets 400 + -32020. events/list stays exempt.
• Check the Go events client (experimental/ext/events/clients/go) goes through the path that sets the header, including events/stream.
• Check the stateless wire (server/stateless/) applies the same validation.
• Tests: header present, missing, mismatched and non-ASCII on each method, plus events/list without a header.
• Separately, in the conformance fork: re-quote sep-3415.yaml at 2ec39b9c and add server and client rows for this rule. The suite cannot grade it until then.

Done when

An events/* request from the mcpkit client carries Mcp-Name, and the mcpkit server answers 400 / -32020 to one that doesn't, on both wires.