Fill SEP-2243 conformance test coverage gaps

Add missing test cases identified by comparing the branch against the
SEP-2243 spec's Conformance Test Cases section:

- Mcp-Method on notifications: add notifications/initialized to
  expectedMethods so clients are checked for header on notifications
- Boolean true: add debug=true param to complement verbose=false
- Leading-space-only and trailing-space-only: separate checks for
  Base64 encoding when only one edge has whitespace
- Internal spaces only: verify plain ASCII (no Base64) for values
  like 'us west 1' that have spaces only in the middle
- CRLF string: add line1\r\nline2 test (complements existing \n test)
- Leading tab: add \tindented test for tab-triggered Base64 encoding
- Server rejects invalid Mcp-Param chars: mark as excluded in YAML
  since HTTP itself prevents these characters in headers

Register all new checks in sep-2243.yaml.

Author: Tarek Mahmoud Sayed

src/scenarios/client/http-custom-headers.ts

@@ -253,12 +253,18 @@ export class HttpCustomHeadersScenario extends BaseHttpScenario {
             region: 'us-west1',
             priority: 42,
             verbose: false,
+            debug: true,
             empty_val: '',
             method_val: 'test-method',
             float_val: 3.14159,
             non_ascii_val: 'Hello, 世界',
             whitespace_val: ' padded ',
+            leading_space_val: ' us-west1',
+            trailing_space_val: 'us-west1 ',
+            internal_space_val: 'us west 1',
             control_char_val: 'line1\nline2',
+            crlf_val: 'line1\r\nline2',
+            tab_val: '\tindented',
             query: 'SELECT * FROM users'
           }
         },
@@ -351,6 +357,11 @@ export class HttpCustomHeadersScenario extends BaseHttpScenario {
                   description: 'Boolean value',
                   'x-mcp-header': 'Verbose'
                 },
+                debug: {
+                  type: 'boolean',
+                  description: 'Boolean true value',
+                  'x-mcp-header': 'Debug'
+                },
                 empty_val: {
                   type: 'string',
                   description: 'Empty string value',
@@ -379,12 +390,42 @@ export class HttpCustomHeadersScenario extends BaseHttpScenario {
                     'String with leading/trailing whitespace — requires Base64 encoding',
                   'x-mcp-header': 'Whitespace'
                 },
+                leading_space_val: {
+                  type: 'string',
+                  description:
+                    'String with leading space only — requires Base64 encoding',
+                  'x-mcp-header': 'LeadingSpace'
+                },
+                trailing_space_val: {
+                  type: 'string',
+                  description:
+                    'String with trailing space only — requires Base64 encoding',
+                  'x-mcp-header': 'TrailingSpace'
+                },
+                internal_space_val: {
+                  type: 'string',
+                  description:
+                    'String with internal spaces only — plain ASCII, no Base64',
+                  'x-mcp-header': 'InternalSpace'
+                },
                 control_char_val: {
                   type: 'string',
                   description:
                     'String with control characters — requires Base64 encoding',
                   'x-mcp-header': 'ControlChar'
                 },
+                crlf_val: {
+                  type: 'string',
+                  description:
+                    'String with carriage return and line feed — requires Base64 encoding',
+                  'x-mcp-header': 'CrLf'
+                },
+                tab_val: {
+                  type: 'string',
+                  description:
+                    'String with leading tab — requires Base64 encoding',
+                  'x-mcp-header': 'Tab'
+                },
                 query: {
                   type: 'string',
                   description:
@@ -474,6 +515,11 @@ export class HttpCustomHeadersScenario extends BaseHttpScenario {
         });
       }
 
+      // Check Mcp-Param-Debug header (boolean true value)
+      if (args.debug !== undefined && args.debug !== null) {
+        this.checkParamHeader(req, 'Debug', args.debug, 'boolean');
+      }
+
       // Check Mcp-Param-EmptyVal header (empty string → empty header value)
       if (args.empty_val !== undefined && args.empty_val !== null) {
         this.checkParamHeader(req, 'EmptyVal', args.empty_val, 'string');
@@ -499,6 +545,45 @@ export class HttpCustomHeadersScenario extends BaseHttpScenario {
         this.checkParamHeader(req, 'Whitespace', args.whitespace_val, 'string');
       }
 
+      // Check Mcp-Param-LeadingSpace header (leading space only → Base64)
+      if (
+        args.leading_space_val !== undefined &&
+        args.leading_space_val !== null
+      ) {
+        this.checkParamHeader(
+          req,
+          'LeadingSpace',
+          args.leading_space_val,
+          'string'
+        );
+      }
+
+      // Check Mcp-Param-TrailingSpace header (trailing space only → Base64)
+      if (
+        args.trailing_space_val !== undefined &&
+        args.trailing_space_val !== null
+      ) {
+        this.checkParamHeader(
+          req,
+          'TrailingSpace',
+          args.trailing_space_val,
+          'string'
+        );
+      }
+
+      // Check Mcp-Param-InternalSpace header (internal spaces only → plain ASCII, no Base64)
+      if (
+        args.internal_space_val !== undefined &&
+        args.internal_space_val !== null
+      ) {
+        this.checkParamHeader(
+          req,
+          'InternalSpace',
+          args.internal_space_val,
+          'string'
+        );
+      }
+
       // Check Mcp-Param-ControlChar header (control characters → Base64)
       if (
         args.control_char_val !== undefined &&
@@ -512,6 +597,16 @@ export class HttpCustomHeadersScenario extends BaseHttpScenario {
         );
       }
 
+      // Check Mcp-Param-CrLf header (carriage return + line feed → Base64)
+      if (args.crlf_val !== undefined && args.crlf_val !== null) {
+        this.checkParamHeader(req, 'CrLf', args.crlf_val, 'string');
+      }
+
+      // Check Mcp-Param-Tab header (leading tab → Base64)
+      if (args.tab_val !== undefined && args.tab_val !== null) {
+        this.checkParamHeader(req, 'Tab', args.tab_val, 'string');
+      }
+
       // Check that 'query' (no x-mcp-header) is NOT mirrored
       const queryHeader = req.headers['mcp-param-query'] as string | undefined;
       if (queryHeader !== undefined) {

src/scenarios/client/http-standard-headers.ts

@@ -80,8 +80,10 @@ export class HttpStandardHeadersScenario implements Scenario {
 
   getChecks(): ConformanceCheck[] {
     // Enforce that Mcp-Method was checked for all expected request types
+    // SEP-2243 requires Mcp-Method on "all requests and notifications"
     const expectedMethods = [
       'initialize',
+      'notifications/initialized',
       'tools/list',
       'tools/call',
       'resources/list',

src/scenarios/sep-2243.yaml

@@ -3,6 +3,8 @@ spec_url: https://modelcontextprotocol.io/specification/draft/basic/transports
 requirements:
   - text: 'HTTP POST requests MUST include the Mcp-Method header mirrored from the JSON-RPC method for all requests and notifications.'
     check: client-mcp-method-header-initialize
+  - text: 'HTTP POST notifications MUST include the Mcp-Method header mirrored from the JSON-RPC method.'
+    check: client-mcp-method-header-notifications-initialized
   - text: 'tools/call requests MUST include the Mcp-Name header mirrored from params.name.'
     check: client-mcp-name-header-tools-call
   - text: 'resources/read requests MUST include the Mcp-Name header mirrored from params.uri.'
@@ -51,6 +53,8 @@ requirements:
     check: client-custom-header-priority
   - text: 'Clients MUST convert boolean parameter values to lowercase true/false before mirroring them into Mcp-Param headers.'
     check: client-custom-header-verbose
+  - text: 'Clients MUST convert boolean true to lowercase "true" before mirroring into Mcp-Param headers.'
+    check: client-custom-header-debug
   - text: 'If an x-mcp-header parameter value is provided, the client MUST include the corresponding Mcp-Param header.'
     check: client-custom-header-optional-present
   - text: 'If an x-mcp-header parameter value is null or omitted, the client MUST omit the corresponding Mcp-Param header.'
@@ -59,8 +63,18 @@ requirements:
     check: client-custom-header-nonascii
   - text: 'When a value has leading or trailing whitespace, clients MUST use the =?base64?...?= wrapper.'
     check: client-custom-header-whitespace
+  - text: 'When a value has leading whitespace only, clients MUST use the =?base64?...?= wrapper.'
+    check: client-custom-header-leadingspace
+  - text: 'When a value has trailing whitespace only, clients MUST use the =?base64?...?= wrapper.'
+    check: client-custom-header-trailingspace
+  - text: 'When a value has internal spaces only (no leading/trailing), clients MUST send it as plain ASCII without Base64.'
+    check: client-custom-header-internalspace
   - text: 'When a value contains control characters, clients MUST use the =?base64?...?= wrapper.'
     check: client-custom-header-controlchar
+  - text: 'When a value contains carriage return and line feed, clients MUST use the =?base64?...?= wrapper.'
+    check: client-custom-header-crlf
+  - text: 'When a value has a leading tab, clients MUST use the =?base64?...?= wrapper.'
+    check: client-custom-header-tab
   - text: 'Servers that inspect Base64-encoded Mcp-Param values MUST decode them before comparing them with the request body.'
     check: server-accepts-valid-base64
   - text: 'Servers MUST reject requests with invalid Base64 padding in Mcp-Param values.'
@@ -85,3 +99,5 @@ requirements:
     check: client-custom-header-no-mirror-unannotated
   - text: 'Intermediaries MUST return an appropriate HTTP error status for validation failures.'
     excluded: 'Applies to network intermediaries rather than the MCP client or server implementation under test.'
+  - text: 'Servers MUST reject requests with Mcp-Param headers that contain invalid characters per RFC 9110.'
+    excluded: 'HTTP itself prevents invalid characters (CR, LF, null, non-ASCII) in header values; standard HTTP libraries reject them before the server can process them, making this untestable through conformance tests.'