MCP server card

Supporting documents: MCP server card proposal

Lumar readiness bar: no specification requires this. Bad: the published card doesn't parse as JSON, so agents can't read it at all. Fix: serve valid JSON (check for trailing commas or comments; validate with a JSON linter).

Supporting documents: MCP server card proposal

Lumar readiness bar: no specification requires this. Bad: the card declares an endpoint that is not an absolute http(s) URL (such as "example.com/mcp", missing its scheme), so a client cannot connect to it. A card with no endpoint at all is not flagged: the server-card format makes it optional. Fix: give the full URL, e.g. "remotes": [{ "type": "streamable-http", "url": "https://mcp.example.com/mcp" }].

Supporting documents: MCP transports, 2025 version (the older connection handshake)

Related guidance in MCP transports, 2025 version (the older connection handshake). Bad: the endpoint the card advertises answered an MCP handshake with a normal HTTP 2xx page instead of a JSON-RPC reply, so no MCP client can connect to it — the card points somewhere real, but not at an MCP server. Fix: point the card at a working MCP Streamable HTTP endpoint, e.g. "url": "https://mcp.example.com/mcp", or withdraw the card until one exists. Only a 2xx non-JSON-RPC answer sets this: a 401 or 403 (authorization may be required) and an unreachable endpoint never do.

Supporting documents: MCP server card proposal

Lumar readiness bar: no specification requires this. Bad: every endpoint the card advertises answered HTTP 404 or 410, so the card points only at addresses that do not exist and an agent has nowhere to connect. Fix: publish a working MCP endpoint at the advertised URL, or remove the declarations that are no longer served. A 401 or 403 is not this (authorization may be required), and neither is a timeout.

Supporting documents: MCP tools

Required by MCP tools. Bad: a tool in the server's tools/list has no name, and the name is the identifier a client calls, so that tool can never be invoked. Fix: give every listed tool a unique name.

Supporting documents: MCP tools

Required by MCP tools. Bad: a listed tool declares no inputSchema, so an agent has no way to build a valid call to it. Fix: give every tool a JSON Schema for its parameters, e.g. {"type":"object","properties":{}} for a tool that takes none.

Supporting documents: MCP tools

Related guidance in MCP tools. Bad: two listed tools share a name. MCP defines the name as the tool's unique identifier, so a call naming it is ambiguous and a client may invoke the wrong one. Fix: give every tool a distinct name.

Supporting documents: MCP Server Card discovery and security draft

Required by MCP Server Card discovery and security draft. Provisional security check; precision has not yet been measured. Bad: the public server card includes a literal credential or a secret input default that readers can use. Fix: remove the value, rotate the credential and prompt authorized users through a secure channel.

Exposed identity material or weak authentication can enable identity misuse.

Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: MCP tools

Related guidance in MCP tools. Provisional security check; precision has not yet been measured. Bad: a tool parameter named like a credential (password, token, API key) is marked x-mcp-header, so clients on MCP 2026-07-28 or later copy it into an HTTP header every proxy and log can read; MCP says servers should not do this. Fix: remove x-mcp-header from it and take credentials through authorization instead.

An MCP declaration exposes or routes credential material unsafely.

Token validity, scope and downstream compromise are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

An advertised HTTP destination permits unencrypted communication.

Only advertised transport configuration is observed; API deployment security is not fully assessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Public discovery metadata reveals internal service addresses.

Reachability, authorization and SSRF exploitation are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: MCP server card proposal

Lumar readiness bar: no specification requires this. Bad: a listed tool has no description, so an agent can see the tool exists but cannot tell what it does or when to call it, and will skip it. Fix: describe what each tool does and when to use it, e.g. "description": "Look up current order status by order id".

Supporting documents: MCP Streamable HTTP transport, MCP Authorization

Lumar readiness bar: no specification requires this. Provisional security check; precision has not yet been measured. Bad: the card advertises a public MCP endpoint on plain http://, so every tool call and its arguments, and the access token when the server asks for one, travel unencrypted. A Lumar bar: the transport spec states no scheme rule. Fix: serve the endpoint over https and advertise "url": "https://example.com/mcp".

An advertised agent communication path lacks confidentiality.

Runtime message integrity and authorization are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: JSON-RPC 2.0 Specification

Related guidance in JSON-RPC 2.0 Specification. Bad: the endpoint answered a JSON-RPC method it does not implement with a result rather than an error, so a client cannot tell a supported call from an unsupported one. Fix: return a JSON-RPC error with code -32601 for methods the server does not implement.

Supporting documents: MCP tools

MCP tools permits this, so it never fails the site. Informational (does not affect mcpServerValid): a tool name falls outside the portable format MCP recommends from revision 2026-07-28 — 1 to 128 characters of ASCII letters, digits, underscore, hyphen or dot, with no spaces or other special characters. Every clause in that section is a SHOULD, and it is only applied to servers declaring that revision or later, so an older server is never judged by guidance written after it. Consider renaming for portability across clients.

Supporting documents: MCP server card proposal

Lumar readiness bar: no specification requires this. Informational (does not affect mcpServerValid): the card advertises more than one endpoint, at least one serves MCP and at least one does not, so an agent choosing the wrong entry gets nothing. The card still works, which is why this is not a defect. Consider removing the endpoint that no longer serves MCP so every advertised address is live.

Supporting documents: MCP server card proposal

Lumar readiness bar: no specification requires this. Informational (does not affect mcpServerValid): a reachable endpoint is advertised but declares no transport; the draft may infer it (or use the registry "type"). Consider declaring the transport alongside the url, e.g. "transport": "streamable-http".