All checks › API, Auth, MCP & Skills
MCP Server Card
Why it matters
MCP has become the de facto standard that production agent products use to connect to external tools and data. To be transparent: MCP's official discovery mechanism today is the MCP Registry (a central registry, modelcontextprotocol.io/registry, with namespace verification via GitHub/DNS). The per-domain file at /.well-known/mcp/server-card.json comes from an MCP community proposal (SEP-1649 and follow-up proposals) not yet ratified in the specification -- publishing it means adopting early a format that may still change. That said, if the implementation behind it is real, the MCP server inherits the same security responsibility as any public API: input validation, rate limiting and a well-defined permission scope — an agent that can call a function is, in practice, a new entry point into your system.
Want to see how your site does?
The free scan runs this and every other check in about 30 seconds and shows the evidence for each one.
Scan my site for free