Fix: Legacy MCP card paths redirect to the canonical card
Web-audit fix skill for the
mcp-card-legacy-aliasescheck (MCP, MAY).
Goal
Point every legacy MCP card path at the canonical card instead of serving its own copy.
Fix
Serve whichever legacy pointer paths you publish (/.well-known/mcp, /.well-known/mcp.json, /mcp.json) as 301 redirects to /.well-known/mcp/server-card.json. A legacy path that answers with its own JSON body is a second source of truth that may drift from the canonical card, and a 302/307 or a redirect to any other location sends agents somewhere else. Paths you never published need no redirect.
Resources
Copy-paste prompt
Paste this into your coding agent. Your audit adds what it observed for this check:
Verify
Re-run the audit at https://anc.dev/audit or call the audit_website MCP tool; the mcp-card-legacy-aliases check should report pass.