Intent: an agent that knows only the host finds the MCP server without reading prose.
Seen: /.well-known/mcp and /.well-known/mcp.json are 404; the MCP endpoint and its OAuth metadata are only named in /llms.txt and /api/v1/here.
Done:
[ ] GET /.well-known/mcp.json answers JSON: the server's name and version, its endpoint (<origin>/mcp, transport streamable HTTP), the protected-resource metadata URL, and the tool that needs no token (report)
[ ] the same values the mcp block of /api/v1/here gives, from one function, so they cannot drift
[ ] /llms.txt's "For agents" section links the card
[ ] a test reads the card and checks each field against the live routes
Files: src/web/standards.ts (beside security.txt), the llms.txt builder, one test.
Risk: the server-card format is still a draft; name only fields we can keep true, and say so in docs/MCP.md.
Intent: an agent that knows only the host finds the MCP server without reading prose.
Seen:
/.well-known/mcpand/.well-known/mcp.jsonare 404; the MCP endpoint and its OAuth metadata are only named in /llms.txt and/api/v1/here.Done:
GET /.well-known/mcp.jsonanswers JSON: the server's name and version, its endpoint (<origin>/mcp, transport streamable HTTP), the protected-resource metadata URL, and the tool that needs no token (report)mcpblock of/api/v1/heregives, from one function, so they cannot driftFiles: src/web/standards.ts (beside security.txt), the llms.txt builder, one test. Risk: the server-card format is still a draft; name only fields we can keep true, and say so in docs/MCP.md.