Promotion validation permits client-derived values to target reserved x-mcp-* and x-a2a-* headers

[leseb]

Clawpatch finding

• Severity: medium
• Category: security
• Confidence: high
• Finding ID: fnd_sig-feat-custom-apis-anthropic-c_1dd5a85ba7
• Feature: feat_custom_apis_anthropic_classifier
• Source commit: b144a3dfbf0b46353cc17acfe2f85f7e8d7739e6
• Prior-run overlap: Related to prior promotion-header findings and closed issue Configurable AI promotion headers can target transport and credential headers #554; narrower residual x-mcp-* / x-a2a-* gap after PR fix: reject unsafe configurable AI promotion headers #974.

Evidence

• apis/src/promotion.rs:172-182 (is_unsafe_promotion_target_lowercase)
• apis/src/anthropic/messages_format/config.rs:145-153 (validate_anthropic_format_headers)
• apis/src/anthropic/messages_format/mod.rs:244-269 (promote_headers)

Description

Configuration such as headers.model: x-mcp-method or headers.format: x-a2a-family passes validation, after which an untrusted request body supplies the reserved internal header value. Because body promotions occur inside the request-processing lifecycle, this bypasses the boundary that rejects client-supplied reserved headers and can influence later MCP or A2A routing/classification logic.

Reproduction

Configure anthropic_messages_format with headers.model: x-mcp-method, then submit a Messages body whose model is tools/call. Configuration succeeds and the filter emits x-mcp-method: tools/call from client-controlled JSON instead of rejecting the reserved target.

Recommendation

Treat x-mcp-* and x-a2a-* as unsafe promotion targets alongside x-praxis-*, except for narrowly documented dedicated headers if any legitimate producer requires them.

[leseb]

This issue requires human review before any work can begin. Do not self-assign and Do not submit a PR before the issue has been validated.