# Fix: A .well-known MCP server card is published (SEP-1649)

> Web-audit fix skill for the `well-known-mcp-card` check (MCP & API, SHOULD).

## Goal

Publish an MCP server card at the canonical SEP-1649 path and 301 the legacy aliases to it.

## Fix

Publish an MCP server card at `/.well-known/mcp/server-card.json` (SEP-1649) naming the
endpoint, transport, and capabilities: include `mcp_endpoint` (or `url`, or
`transport.endpoint`), `serverInfo`, and the transport type. Serve the legacy pointer paths
(`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to the
canonical, never as duplicate inline copies.

## Resources

- [SEP-1649](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127)

## Copy-paste prompt

Paste this into your coding agent, replacing the Issue line with the Result line from [your audit](https://anc.dev/web-audit):

```text
Goal: Publish an MCP server card at the canonical SEP-1649 path and 301 the legacy aliases to it
Issue: <the audit's finding for this check>
Fix: Publish an MCP server card at `/.well-known/mcp/server-card.json` (SEP-1649) naming the endpoint, transport, and capabilities: include `mcp_endpoint` (or `url`, or `transport.endpoint`), `serverInfo`, and the transport type. Serve the legacy pointer paths (`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to the canonical, never as duplicate inline copies.
Skill: https://anc.dev/web-audit/skill/well-known-mcp-card
Docs: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127
```

## Verify

Re-run the audit at [https://anc.dev/web-audit](https://anc.dev/web-audit) or call the `audit_website` MCP tool; the `well-known-mcp-card` check should report `pass`.