# Fix: Legacy MCP card paths redirect to the canonical card

> Web-audit fix skill for the `mcp-card-legacy-aliases` check (MCP, MAY).

## Goal

Point every legacy MCP card path at the canonical card instead of serving its own copy.

## Fix

Serve whichever legacy pointer paths you publish (`/.well-known/mcp`, `/.well-known/mcp.json`,
`/mcp.json`) as `301` redirects to `/.well-known/mcp/server-card.json`. A legacy path that
answers with its own JSON body is a second source of truth that may drift from the canonical
card, and a `302`/`307` or a redirect to any other location sends agents somewhere else.
Paths you never published need no redirect.

## Resources

- [SEP-1649](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Point every legacy MCP card path at the canonical card instead of serving its own copy
Fix: Serve whichever legacy pointer paths you publish (`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to `/.well-known/mcp/server-card.json`. A legacy path that answers with its own JSON body is a second source of truth that may drift from the canonical card, and a `302`/`307` or a redirect to any other location sends agents somewhere else. Paths you never published need no redirect.
Skill: https://anc.dev/fix/mcp-card-legacy-aliases
Docs: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `mcp-card-legacy-aliases` check should report `pass`.