Commit graph

21 commits

Author SHA1 Message Date
Tadas Antanavicius
bd9bcce280
Add DoS section (#24)
Closes
https://github.com/modelcontextprotocol/experimental-ext-server-card/issues/21
2026-06-08 12:49:33 -07:00
Tadas Antanavicius
10e958fa82
Server Cards: recommend /server-card over .well-known (resolves #12) (#22)
Resolves #12.

## What & why

Moves the **single-server Server Card** off a `.well-known` path. We
reserve `GET <streamable-http-url>/server-card` as the recommended
location while allowing **any unreserved URI** — the Catalog
(`/.well-known/mcp/catalog.json`) is the discovery entrypoint and
already carries each card's `url`, so clients never need to guess where
a card lives.

Adopts wording close to the resolution discussed in #12 (credit: Darrel
Miller's point that `.well-known` is for *site-wide* metadata, not
application-level metadata like an individual server's card; proposed
wording from @SamMorrowDrums and @tadasant):

> MCP Servers MAY host their Server Card at `GET
<streamable-http-url>/server-card`, which we reserve for this purpose,
though any unreserved URI is valid. MCP Servers SHOULD respect the
agreed media type wherever they choose to host it. After a client
identifies a Server Card URL from an AI Catalog or MCP Catalog, it
SHOULD request that URL expressing the Server Card media type.

### Content negotiation

A client fetching a Server Card requests its preferred representation
with the `Accept` header (`Accept: application/mcp-server-card+json`) —
the request-side content-negotiation header for a GET. The server echoes
the type it actually served back in the response's `Content-Type`.

> **Note on media type:** this PR is scoped to *placement* only and does
**not** perform the `application/mcp-server+json` →
`application/mcp-server-card+json` rename — that is handled in a
separate PR. So the two coexist deliberately here:
> - **Pre-existing strings** (catalog-entry description, the four
example `mediaType` values, validation prose, and the "Server Cards use
the media type" line) are left as `application/mcp-server+json`,
untouched, for the rename PR to sweep.
> - **New prose introduced by this PR** (the reserved-location
blockquote and the `Accept`-header example in the "Server Card Location"
section) names the type explicitly as the **post-rename
`application/mcp-server-card+json`**, since the rename PR's diff is
against `main` and would not touch text that doesn't yet exist there.
>
> The temporary mix resolves to a single consistent type once both PRs
land.

## Rationale for `/server-card` (also captured permanently in
`docs/discovery.md` → "Alternatives considered")

- **Not `.well-known`:** site-wide vs. application-level metadata; the
Catalog already provides the `url`, so `.well-known` adds no value for
the card.
- **Not the bare streamable-HTTP endpoint** (`GET <url>` with no
suffix): a GET there already opens the SSE stream in Streamable HTTP.
Hosting the card there overloads the connection-establishing endpoint
and forces content negotiation to disambiguate. Spec-*allowed*,
explicitly **not recommended** — this is the primary motivation for a
distinct suffix.
- **Not domain-root `/mcp/` nesting:** `/mcp` denotes the *transport
endpoint itself* in MCP's canonical-URI examples; there's no precedent
for `/mcp/` as a metadata sub-namespace, and it collides conceptually
with "the JSON-RPC endpoint."
- **Elegant consequence:** because the suffix is appended to the
streamable-HTTP URL, a server at `https://host/mcp` naturally yields
`https://host/mcp/server-card` — path-namespacing for free.

## Scope guardrail

This applies **only to the single-server Server Card**. `.well-known` is
unchanged and remains correct for the **Catalog**
(`/.well-known/mcp/catalog.json`) and OAuth metadata
(`/.well-known/oauth-protected-resource`, etc.) — those are genuinely
site-wide. The doc calls this out explicitly so it doesn't read as
"abandon `.well-known` everywhere."

## Files changed

- **`docs/discovery.md`** — new "Server Card Location" section with the
reserved convention + `Accept`-header guidance; permanent "Alternatives
considered" subsection; rewritten single- and multi-server example URLs
(`https://example.com/mcp/server-card`;
`https://acme.com/code-review/server-card`, `/docs-search/server-card`,
`/ci-cd/server-card`).
- **`schema.ts`** — updated the two `.well-known` doc comments
(`ServerCard` and `Server`) to the new convention.
- **`schema.json`** — regenerated from `schema.ts` (`npm run generate`).
- **`README.md`** — updated the "What is a Server Card?" line to the new
convention, normalizing the pre-existing README-vs-schema `.well-known`
mismatch.

## Verification

- [x] `npm run check` passes (schema.json in sync with schema.ts + `tsc
--noEmit` clean)
- [x] `npm run generate` run and regenerated `schema.json` committed in
the same change
- [x] `npm run validate` passes — all 7 examples validate against the
regenerated schema
- [x] `npm run format` run (prettier clean)
- [x] No single-server-card `.well-known` references remain in
`README.md`, `schema.ts`, `schema.json`, or `docs/discovery.md`
(verified via grep); remaining `.well-known` references are
Catalog/OAuth/the "Alternatives considered" explainer only
- [x] Pre-existing media-type strings left untouched — `git diff
origin/main` shows zero changes to existing
`application/mcp-server+json` strings (rename owned by a separate PR);
only the new placement prose names the post-rename
`application/mcp-server-card+json`
- [x] Examples updated and internally consistent with the new prose
- [x] Fresh-eyes subagent review performed; its one cosmetic finding was
addressed and CI re-confirmed green
- [x] CI green (see checks on this PR)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Agent (Claude) <peter@tadasant.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:40:51 -07:00
Tadas Antanavicius
7c340f43e7
docs: add AGENTS.md (CLAUDE.md symlink) for AI coding agents (#20)
## What & why

Adds an **`AGENTS.md`** (with a **`CLAUDE.md` symlink**) at the repo
root — a concise operating manual for AI coding agents contributing to
this repository.

It is deliberately **minimal and non-duplicative**:
[`README.md`](./README.md) remains the source of truth for everything
mechanical (what a Server Card is, the layout, the `npm run
generate`/`check`/`validate`/`format` workflow, the
`schema.ts`→`schema.json` regeneration rule, the `$schema` URL
convention, the graduation plan), and `AGENTS.md` points to it rather
than restating it. `AGENTS.md` adds only the **contribution conduct the
README doesn't cover**:

- **Open PRs for human review — do not self-merge AI-generated
changes**, even with merge permissions.
- Keep changes small and scoped; one coherent change per PR; link the
relevant SEP/issue.
- Respect the experimental, SEP-2127-tracked nature; don't pre-empt
unresolved spec discussion; keep the graduation path intact.
- Treat the schema as a public contract; flag breaking changes
explicitly.

`AGENTS.md` is the portable, tool-agnostic entry point; `CLAUDE.md` is a
symlink to it so Claude Code loads it automatically — one file, two
entry points, zero duplication.

## Verification

- [x] **`npm run check` passes** (schema.json in sync, `tsc --noEmit`
clean): `✓ schema.json is up to date`
- [x] **`npm run validate` passes**: `All 7 example(s) passed.`
- [x] **`npm run format:check` passes** (the new `AGENTS.md` is
Prettier-clean): `All matched files use Prettier code style!`
- [x] **Change is docs-only** — adds `AGENTS.md` + `CLAUDE.md` symlink;
no `schema.ts`/`schema.json`/examples touched
- [x] **`CLAUDE.md` is a symlink to `AGENTS.md`** (verified `ls -l`:
`CLAUDE.md -> AGENTS.md`), no content duplication
- [x] **No README duplication** — `AGENTS.md` references `README.md` for
all mechanics and only adds contribution conduct (verified by re-reading
both files side by side after a fresh-eyes review)
- [x] **CI green on this PR**: `build`, `CodeQL`, and `Analyze
(actions)` all pass (re-confirmed after each revision)

---
🤖 Opened by an AI coding agent for human review — **not** to be
self-merged (per the contribution norms in this very PR). Please review
and merge if it looks good.
2026-06-08 08:16:20 -07:00
Sam Morrow
ad000df044
Merge pull request #19 from modelcontextprotocol/sammorrowdrums/fix-discovery-md-primitives
docs: remove primitives from Server Card contents (fixes #10)
2026-06-08 13:03:28 +02:00
Sam Morrow
ee1f187084
Merge remote-tracking branch 'origin/main' into pr/19/sammorrowdrums/fix-discovery-md-primitives
# Conflicts:
#	docs/discovery.md
2026-06-08 13:02:09 +02:00
Sam Morrow
ecc77a4bd8
Merge pull request #18 from modelcontextprotocol/sammorrowdrums/docs-align-mediatype-with-ai-catalog 2026-06-08 09:30:19 +02:00
Sam Morrow
ac36447c8d style: prettier formatting
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-05 22:15:29 +02:00
Sam Morrow
1ff3c61b35 docs: remove primitives from Server Card contents (fixes #10)
The 'A Server Card includes:' list in docs/discovery.md mentioned
'Capabilities — Tools, resources, and prompts the server offers',
which contradicts schema.ts and SEP-2127: Server Cards do not
enumerate primitives. Primitives remain subject to runtime listing
via the protocol's standard list operations.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-05 22:13:39 +02:00
Sam Morrow
877e62682c docs: align Catalog mediaType with AI Catalog spec
Replace application/mcp-server+json with application/mcp-server-card+json
in docs/discovery.md to match the AI Catalog specification, which
discovery.md cites as the standard MCP Catalog entries are a subset of.

Fixes #9

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-05 22:13:08 +02:00
David Soria Parra
ffe58b0fe3
Merge pull request #3 from modelcontextprotocol/sammorrowdrums/mcp-catalog-discovery-spec
Add MCP Catalog discovery specification
2026-05-28 19:51:20 +01:00
Sam Morrow
b4135246f1
docs(discovery): port authoritative fix from upstream PR
Replaces the prior reconstruction with the canonical content from commit
bb3bd697 on SamMorrowDrums/modelcontextprotocol@sammorrowdrums/mcp-catalog-specification,
adapted from .mdx to plain .md (frontmatter and Mintlify components stripped,
content preserved verbatim).

Covers all of tadasant's review feedback: internal MCP Server Cards subsection,
.json well-known path, reverse-DNS identifiers, identifier MUST constraint,
cross-domain advertising language, SHOULD-publish recommendation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-25 21:27:42 +02:00
Sam Morrow
9e3b3d7c9d
docs(discovery): address tadasant review feedback
- Add MCP Server Card subsection defining application/mcp-server+json
  and link 'MCP Server Cards' references internally rather than to SEP-2127
- Reframe domain hosting language to support cross-host advertising
  (catalog MAY reference servers on different web hosts)
- Switch well-known URI to /.well-known/mcp/catalog.json
- Add SHOULD-publish recommendation for organizations offering MCP services
- Make specVersion OPTIONAL with note about pushing AI Catalog to align
- Tighten identifier definition: MUST begin with urn:mcp:server: and the
  remainder MUST exactly match the server card's name
- Update all examples to use reverse-DNS identifiers
- Keep Content-Type: application/json for the catalog itself
- Add cross-host advertising example and trust considerations

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-25 21:27:42 +02:00
Sam Morrow
55996b594b
Add MCP Catalog discovery specification
Add docs/discovery.md defining the MCP Catalog format for config-free
auto-discovery of MCP server cards via a well-known URI. The catalog is
a minimal, MCP-scoped subset of the AI Catalog specification.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-25 21:27:42 +02:00
Sam Morrow
c20e3b0245
Merge pull request #5 from modelcontextprotocol/sammorrowdrums/regenerate-schema-json
chore: regenerate schema.json to match schema.ts
2026-05-18 21:06:23 +02:00
Sam Morrow
9b087e192e
Merge pull request #4 from modelcontextprotocol/dependabot/npm_and_yarn/npm_and_yarn-c92791b708
Bump vm2 from 3.10.5 to 3.11.2 in the npm_and_yarn group across 1 directory
2026-05-18 15:51:11 +02:00
Sam Morrow
c5bb562f73
chore: format schema.json with prettier in generator
Wire prettier into scripts/generate-schema.ts so the generated schema.json
matches the repo's prettier config, fixing the failing `format:check` CI job.
Regenerated schema.json to apply the formatting.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-18 15:50:17 +02:00
Sam Morrow
bc3a0995d7
chore: regenerate schema.json to match schema.ts
The committed schema.json had drifted from schema.ts, causing
`npm run check` (and therefore the `build` CI job) to fail on
every PR. Regenerated via `npm run generate`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-18 15:48:02 +02:00
dependabot[bot]
5167f38d62
Bump vm2 in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [vm2](https://github.com/patriksimek/vm2).


Updates `vm2` from 3.10.5 to 3.11.2
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/main/CHANGELOG.md)
- [Commits](https://github.com/patriksimek/vm2/compare/v3.10.5...v3.11.2)

---
updated-dependencies:
- dependency-name: vm2
  dependency-version: 3.11.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-08 14:45:46 +00:00
Sam Morrow
f258108469
Merge pull request #1 from tadasant/init/server-card-types
Bootstrap repo with TypeScript types and JSON Schema for SEP-2127
2026-04-28 00:44:52 +02:00
Tadas Antanavicius
7a3ff5d452 Bootstrap repo with TypeScript source-of-truth and generated JSON Schema
Tracks SEP-2127 (MCP Server Cards) as an experimental extension while the SEP
itself is under review. The schema.ts is structured to be lifted directly into
schema/draft/schema.ts of the main spec when Server Cards graduate -- only the
inlined MetaObject and Icon definitions need to be removed during migration.

- schema.ts: ServerCard, Server, Repository, Remote, Package, Argument, Input,
  KeyValueInput, etc. plus inlined MetaObject and Icon
- scripts/generate-schema.ts: typescript-json-schema with 2020-12 transforms
- scripts/validate-examples.ts: ajv validator over examples/{ServerCard,Server}/
- examples/: 2 valid + 4 invalid Server Card cases, 1 valid Server case
- README: status, layout, schema URL conventions, graduation plan
- CI workflow: check + validate + format on every PR
2026-04-27 19:47:01 +00:00
Sam Morrow
bca85e53ca
Initial commit 2026-04-27 21:19:27 +02:00