| name | mcp-server-card |
| description | Use when authoring, validating, hosting, or reviewing an experimental MCP Server Card for remote pre-connection discovery. |
| version | 0.1.0 |
MCP Server Cards
Server Cards are experimental pre-connection discovery metadata. They are advisory: a client must not use a card as an authorization decision, and the card must remain consistent with runtime server/discover behavior.
Contract
- The draft source requires
$schema: "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json", but that URL returned 404 on 2026-07-29. Keep the required draft value in a fixture; validate against upstream schema.json and recheck publication before shipping.
name is reverse-DNS-like with exactly one slash: com.example/inventory.- Include
version, a concise description, and a remotes entry for each intended remote endpoint.
- A
remote has type: "streamable-http" | "sse", url, optional typed header inputs, optional URL/header variables, and optional supportedProtocolVersions.
- Do not list tools, prompts, or resources. Clients obtain those at runtime.
- Cards may be hosted at any unreserved URI.
GET <streamable-http-url>/server-card is recommended, but a catalog tells clients where to find it; do not guess arbitrary paths.
Variables and headers
Declare a URL placeholder in remote.variables. Declare a connection header as a named remote.headers KeyValueInput; mark secrets with isSecret: true. Use value only for non-user-configurable values and never put a bearer token in it. Header values can reference their own variables.
Authoring pattern
Source-derived TypeScript must import ServerCard from the upstream schema source rather than reconstructing a parallel interface. See references/server-card.ts. Keep generated JSON minimal and validate it with scripts/validate-fixtures.mjs.
Security and truthfulness
Publish only card values that match the real endpoint, including supported protocol versions. Do not claim auth policy, tool availability, or user authorization from a card. Treat downloaded icon and website URLs as untrusted content.
References
references/server-card.ts — direct upstream type importfixtures/ — valid card plus invalid unknown-field fixturescripts/validate-fixtures.mjs — Ajv CLI schema validationreferences/versions.md — source and schema URL ledger
