Skip to content

DISC-012Find

MCP server card published

Whether your shop publishes an MCP server card at a well-known path, telling agents about a Model Context Protocol server you run.

What we check

We look for an MCP server card at /.well-known/mcp/server-card.json and then at /.well-known/mcp.json. MCP server cards are an unratified proposal. SEP-2127 is an open pull request, still in review, and is not part of the MCP specification revision of 2026-07-28. These two paths come from an earlier draft (SEP-1649). The current SEP-2127 draft moves discovery to the ARD catalogue, which DISC-016 reads. We accept two card shapes. The SEP-2127 shape needs non-empty name, version and description. The SEP-1649 shape needs serverInfo.name plus a transport or capabilities object.

Why it matters

An MCP server lets an AI agent call your shop's tools directly, such as searching products or checking an order, without reading web pages. A card at a predictable address tells an agent that the server exists and how to connect. This check does not look at a Shopify storefront's own MCP endpoint, which DISC-007 covers.

How we check

We request the first path and move to the second only if the first is absent. PASS: a JSON card in either shape, served as application/json or application/mcp-server-card+json. WARN: the body is not JSON, the JSON matches neither shape (for example a CDN's "not found" message sent with status 200), or the card is served under another media type. FAIL: both paths return 404 or 410, or return your site's ordinary HTML page. SKIPPED: bot management answered, your robots.txt disallows the path for our crawler, or the server returned a status such as 429 or a 5xx. After a SKIPPED first path, we do not request the second.

How to fix it

  1. Publish a card only if your shop runs a public MCP server. Put it at /.well-known/mcp/server-card.json.
  2. Use the SEP-2127 shape: "$schema", "name" (reverse-DNS, for example com.example/shop), "version", "description" and a "remotes" entry with the endpoint URL.
  3. Serve it as application/json (or application/mcp-server-card+json) with Access-Control-Allow-Origin: *.
  4. Also list the server in /.well-known/ard.json (see DISC-016), which is where the current draft points agents.

What good looks like

GET /.well-known/mcp/server-card.json

HTTP/1.1 200 OK
Content-Type: application/json
Access-Control-Allow-Origin: *

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json",
  "name": "com.example/shop",
  "version": "1.2.0",
  "description": "Search the Example Shop catalogue and look up orders.",
  "remotes": [
    { "type": "streamable-http", "url": "https://example.com/api/mcp" }
  ]
}

Sources