Implement SEP-2243: HTTP Standardization

[alexhancock]

SEP-2243: HTTP Standardization — rust-sdk implementation

Spec PR: modelcontextprotocol/modelcontextprotocol#2243
Track: Specification · Stage: final · Priority: P0
Needs code changes: Yes (Medium) — non-breaking (gated by protocol version)

Summary

Incorporates standard HTTP features into the HTTP transport so internet "middle boxes" (proxies,
gateways, load balancers) can process MCP traffic for routing, tracing, and prioritization. All
changes are gated by protocol version, so they are non-breaking. A reference implementation exists
on the C# SDK.

Why this needs code changes in rust-sdk

The SDK already centralizes its HTTP header constants in
crates/rmcp/src/transport/common/http_header.rs: today that's just HEADER_SESSION_ID
(Mcp-Session-Id), HEADER_LAST_EVENT_ID, HEADER_MCP_PROTOCOL_VERSION, and the
text/event-stream / application/json MIME constants, plus a validate_custom_header allow-list.
The server tower (streamable_http_server/tower.rs) and server_side_http.rs build/parse these,
and the client (streamable_http_client.rs) sets them on outgoing requests. Adopting the
standardized header set means adding new constants here and emitting/honoring them on both sides.

The good news: there's a single chokepoint (http_header.rs + the allow-list) for header
definitions, so additions are localized.

Proposed work

• Review the final SEP for the exact header set / semantics (routing, tracing, prioritization) and add the new names as constants in http_header.rs (mirroring the existing HEADER_* pattern).
• Extend the validate_custom_header allow-list so the new headers pass through the middleware (the existing comment shows HEADER_MCP_PROTOCOL_VERSION is already special-cased there).
• Emit the standardized headers on outgoing requests/responses: client in streamable_http_client.rs, server in streamable_http_server/tower.rs / server_side_http.rs.
• Parse and honor them where applicable (e.g. propagate tracing/priority context).
• Gate behind ProtocolVersion::V_2026_07_28 so older peers are unaffected (the protocol version is already available per-request in tower.rs).
• Add tests; cross-check behavior against the C# reference implementation.

Affected areas

transport/common/http_header.rs (new constants + allow-list), transport/common/server_side_http.rs,
transport/streamable_http_client.rs, transport/streamable_http_server/tower.rs.

Notes / risks

• Coordinate with SEP-414 (OpenTelemetry trace context) — tracing headers may overlap.

[DaleSeo]

I'm tackling this since it's blocking Apollo MCP Server!