# Sites with a broken MCP server card A site-wide report: one row per host, over the mcp\_server rows the crawl emitted. ## What this report returns An MCP server card advertises a site's Model Context Protocol server so agents can discover and connect to it. A row appears here when any of these is wrong, worst first: - **Invalid JSON**The published card doesn't parse as JSON, so agents can't read it at all.**Fix** Serve valid JSON (check for trailing commas or comments; validate with a JSON linter). - **Missing URL**The card declares an endpoint that is not an absolute http(s) URL (such as `"example.com/mcp"`, missing its scheme), so a client cannot connect to it. A card with no endpoint at all is not flagged: the server-card format makes it optional.**Fix** Give the full URL, e.g. `"remotes": [{ "type": "streamable-http", "url": "https://mcp.example.com/mcp" }]`. - **Endpoint Not MCP**The endpoint the card advertises answered an MCP handshake with a normal HTTP 2xx page instead of a JSON-RPC reply, so no MCP client can connect to it: the card points somewhere real, but not at an MCP server.**Fix** Point the card at a working MCP Streamable HTTP endpoint, e.g. `"url": "https://mcp.example.com/mcp"`, or withdraw the card until one exists. Only a 2xx non-JSON-RPC answer sets this: a 401 or 403 (authorization may be required) and an unreachable endpoint never do. - **Endpoint Unavailable**Every endpoint the card advertises answered HTTP 404 or 410, so the card points only at addresses that do not exist and an agent has nowhere to connect.**Fix** Publish a working MCP endpoint at the advertised URL, or remove the declarations that are no longer served. A 401 or 403 is not this (authorization may be required), and neither is a timeout. - **Tool Missing Name**A tool in the server's tools/list has no name, and the name is the identifier a client calls, so that tool can never be invoked.**Fix** Give every listed tool a unique name. - **Tool Missing Input Schema**A listed tool declares no `inputSchema`, so an agent has no way to build a valid call to it.**Fix** Give every tool a JSON Schema for its parameters, e.g. `{"type":"object","properties":{}}` for a tool that takes none. - **Duplicate Tool Name**Two listed tools share a name. MCP defines the name as the tool's unique identifier, so a call naming it is ambiguous and a client may invoke the wrong one.**Fix** Give every tool a distinct name. - **Credential Exposed**The public server card includes a literal credential or a secret input default that readers can use.**Fix** Remove the value, rotate the credential and prompt authorized users through a secure channel. - **Sensitive Header Parameter**A tool parameter named like a credential (password, token, API key) is marked x-mcp-header, so clients on MCP 2026-07-28 or later copy it into an HTTP header every proxy and log can read; MCP says servers should not do this.**Fix** Remove x-mcp-header from it and take credentials through authorization instead. - **Tool Missing Description**A listed tool has no description, so an agent can see the tool exists but cannot tell what it does or when to call it, and will skip it.**Fix** Describe what each tool does and when to use it, e.g. `"description": "Look up current order status by order id"`. - **Insecure Endpoint**The card advertises a public MCP endpoint on plain http://, so every tool call and its arguments, and the access token when the server asks for one, travel unencrypted. A Lumar bar: the transport spec states no scheme rule.**Fix** Serve the endpoint over https and advertise `"url": "https://example.com/mcp"`. - **Unknown Method Accepted**The endpoint answered a JSON-RPC method it does not implement with a result rather than an error, so a client cannot tell a supported call from an unsupported one.**Fix** Return a JSON-RPC error with code -32601 for methods the server does not implement. (A missing transport is shown for context but is informational.) Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment. ## The columns it shows Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply. - Host`host` - MCP Server Valid`mcpServerValid` - MCP Server Conformance Issue Detected`mcpServerConformanceIssueDetected` - MCP Server Security Risk Detected`mcpServerSecurityRiskDetected` - MCP Server Findings`mcpServerFindings` - MCP Server Endpoint URL`mcpServerEndpointUrl` - MCP Server Transports`mcpServerTransports` - MCP Server Tool Names`mcpServerToolNames` - MCP Server Invalid JSON`mcpServerInvalidJson` - MCP Server Missing URL`mcpServerMissingUrl` - MCP Server Endpoint Not MCP`mcpServerEndpointNotMcp` - MCP Server Endpoint Unavailable`mcpServerEndpointUnavailable` - MCP Server Tool Missing Name`mcpServerToolMissingName` - MCP Server Tool Missing Input Schema`mcpServerToolMissingInputSchema` - MCP Server Duplicate Tool Name`mcpServerDuplicateToolName` - MCP Server Credential Exposed`mcpServerCredentialExposed` - MCP Server Sensitive Header Parameter`mcpServerSensitiveHeaderParam` - mcpServer HTTPS Downgrade`mcpServerInsecureRedirect` - MCP Server Internal Endpoint`mcpServerInternalEndpoint` - MCP Server Tool Missing Description`mcpServerToolMissingDescription` - MCP Server Insecure Endpoint`mcpServerInsecureEndpoint` - MCP Server Unknown Method Accepted`mcpServerUnknownMethodAccepted` - MCP Server Missing Transport`mcpServerMissingTransport` - MCP Server Stale Endpoint`mcpServerStaleEndpoint` - MCP Server Partially Assessed`mcpServerPartiallyAssessed` - Ruleset Version`rulesetVersion` - Security Check Status`securityCheckStatus` - Related Security Frameworks`securityFrameworkReferences` ## About MCP server card Advertises a Model Context Protocol endpoint agents can call. [Read how MCP server card is checked](https://agentic-readiness.lumar.io/docs/capabilities/mcp-server), including the specification it is validated against and a worked correct and broken example. ## Running it This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. [See the whole set](https://agentic-readiness.lumar.io/scan-at-scale), or check a single URL with the [scanner on this site](https://agentic-readiness.lumar.io/), which runs the same code with no account. [Get Lumar pricing →](https://www.lumar.io/pricing/)