API, Auth, MCP & Skill Discovery

MCP Server Card

A Model Context Protocol Server Card tells an agent that you run an MCP server, where it lives and which transport it speaks.

Why it matters

MCP is how an agent stops scraping your site and starts calling tools you chose to expose.

Pass criteria

/.well-known/mcp/server-card.json describes the server with a serverInfo.name.

What the scanner records
Every request the check makes is recorded (URL, method, response status, relevant headers and a body preview) and shown under the check in your results.

How to implement it

Publish an MCP Server Card for agent discovery

/.well-known/mcp/server-card.json describes the server with a serverInfo.name.

The step-by-step implementation prompt is part of the Pro plan.

See plans

modelcontextprotocol.io github.com SKILL.md

Scan your site

See whether this check passes on your domain, along with the other 21.

Run a scan

Related checks

API Catalog

/.well-known/api-catalog returns application/linkset+json with at least one entry.

OAuth discovery

/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.

OAuth Protected Resource

/.well-known/oauth-protected-resource declares resource and authorization_servers.

Auth.md

/auth.md exists with a markdown H1 mentioning auth.md.

A2A Agent Card

/.well-known/agent-card.json declares name, version and supported interfaces.

Agent Skills

/.well-known/agent-skills/index.json lists at least one skill.

WebMCP

Page code registers browser-side tools through navigator.modelContext.

ARD manifest

/.well-known/ai-catalog.json declares specVersion, host and at least one entry.