.well-known/mcp/server-card.json

What is the MCP server card?

A JSON metadata document describing MCP-relevant information about your site: identity, capabilities, and resources, in the server-card shape being standardized by the Model Context Protocol community. MCP, originated by Anthropic and now the dominant way AI applications connect to tools and data, is adding a discovery layer so agents can find server information at a predictable web path before connecting. This card is your site's entry in that discovery layer.

Why AI agents need it

Pre-connection discovery. MCP's server-card proposals exist so a client can learn a server's capabilities, transports, and auth requirements from a static document instead of manual configuration. As MCP-aware agents start probing .well-known paths, sites with a card are legible; sites without one are blank.

The business value for you

Positioning ahead of the crowd on the fastest-growing protocol in the AI ecosystem, for the cost of a static file. Cloudflare's 2026 agent-readiness analysis found MCP Server Cards and API Catalogs together on fewer than 15 sites in its entire dataset, its authors' takeaway: "there is lots of opportunity to stand out by being one of the first sites to adopt new standards."

Source: Cloudflare, Introducing the Agent Readiness score (2026)

How it came to be

MCP server discovery is being standardized through the protocol's Specification Enhancement Proposal process, SEP-1649 proposed server cards served from the .well-known/mcp/ namespace, with successor proposals (including SEP-2127 and an experimental extension repository) refining the schema and recommended locations. The proposals have broad community support and early client implementations, but have not yet merged into the core MCP specification.

Sources: MCP SEP-1649: Server Cards via .well-known • MCP experimental server-card extension

Adoption

The MCP protocol itself is widely adopted across AI clients and tooling; static server cards on public websites are among the rarest files in the package, single-digit-to-low-double-digit site counts in Cloudflare's dataset. This is the "be early or be invisible" end of the spectrum, and we say so rather than inflating it.

The technical reality

Two things are hard here. First, the upstream path is still in flux: competing proposals use /.well-known/mcp.json, /.well-known/mcp, and /.well-known/mcp/server-card.json. We chose the .well-known/mcp/ namespace so it can grow (for example, a registry file later), and we track the SEPs so your card moves if the standard settles elsewhere. Second, honesty of content: the card must describe real, static capabilities. We do not claim a live MCP server is running on your domain. A live endpoint (at a normal URL like https://yoursite.com/mcp) is a server-side deployment on our roadmap, outside the static package.

What happens if you skip it

Nothing breaks today, and that's the trap. When MCP discovery lands in the core spec and clients start probing, sites with cards are immediately legible and sites without them start from zero. The cost of being early is one static file; the cost of being late is invisibility during the window when early adopters get tested against.