An agent that reads the forge's MCP card also learns where the HTTP contract is. Today /.well-known/mcp.json on production names endpoint, documentation and plugins but not the OpenAPI document. Only /llms.txt and /api names it.
Done:
[ ] mcpJson (src/web/standards.ts:101, card data in src/core/mcp_card.ts) answers an openapi field: ${origin}/contract/openapi.json, an absolute URL on the request's origin.
[ ] test/mcp-card.test.ts asserts the field and that GET on that URL answers 200 application/json in the same test forge.
[ ] docs/MCP.md (or the discovery doc that lists the card's fields) names the field in one line.
Files: src/core/mcp_card.ts, src/web/standards.ts, test/mcp-card.test.ts.
Risk: none. The card is cached for an hour (max-age=3600), so the field shows after one cache turn.
An agent that reads the forge's MCP card also learns where the HTTP contract is. Today /.well-known/mcp.json on production names
endpoint,documentationandpluginsbut not the OpenAPI document. Only /llms.txt and /api names it.Done:
mcpJson(src/web/standards.ts:101, card data in src/core/mcp_card.ts) answers anopenapifield:${origin}/contract/openapi.json, an absolute URL on the request's origin.Files: src/core/mcp_card.ts, src/web/standards.ts, test/mcp-card.test.ts. Risk: none. The card is cached for an hour (
max-age=3600), so the field shows after one cache turn.