Part of epic #3306.

Problem

We already run an MCP server at api/mcp.ts (routed publicly at https://worldmonitor.app/mcp via vercel.json rewrite). Protocol version 2025-03-26, server name worldmonitor, version 1.0, auth via PRO API key Bearer, 60 req/min per-key rate-limited.

What's missing is the discovery manifest — SEP-1649 MCP Server Card at /.well-known/mcp/server-card.json. Without it, MCP clients can't discover our endpoint from the origin; users must paste the /mcp URL manually.

Fix

Publish a static card at public/.well-known/mcp/server-card.json:

{
  "$schema": "https://modelcontextprotocol.io/schemas/server-card.json",
  "serverInfo": {
    "name": "worldmonitor",
    "version": "1.0"
  },
  "transport": {
    "type": "streamableHttp",
    "endpoint": "https://worldmonitor.app/mcp"
  },
  "capabilities": {
    "tools": true,
    "resources": false,
    "prompts": false
  },
  "authentication": {
    "type": "oauth2",
    "authorization_servers": ["https://api.worldmonitor.app"],
    "resource": "https://api.worldmonitor.app",
    "scopes": ["mcp"]
  }
}

Important — align with existing OAuth metadata. public/.well-known/oauth-protected-resource (already live) declares:

• resource: "https://api.worldmonitor.app"
• authorization_servers: ["https://api.worldmonitor.app"]
• scopes_supported: ["mcp"]

The MCP card MUST match these values exactly. We self-host OAuth at api/oauth/{authorize,token,register}.js; we do not delegate to Clerk for MCP auth.

Fields to confirm at implementation

• transport.type — our server is Vercel edge + streamable HTTP; validate against the SEP-1649 schema at landing time (spec still moving).
• capabilities — enumerate from the tool registry in api/mcp.ts (tools only today; no resources/prompts).

Implementation

• Static file at public/.well-known/mcp/server-card.json.
• Content-Type: application/json.
• vercel.json already has /.well-known/(.*) rewrites — verify it doesn't get stripped.
• middleware.ts short-UA guard: confirm .well-known paths aren't 403'd for Node/undici clients (memory: feedback_middleware_short_ua_gate_blocks_node_fetch).
• Register in API catalog (feat(agent-readiness): publish API catalog at /.well-known/api-catalog (RFC 9727) #3309) and Link headers (feat(agent-readiness): add Link response headers for agent discovery (RFC 8288) #3308) once live.
• Because the SEP-1649 schema is still draft, pin a comment in the file citing the PR commit at time-of-ship and revisit when it merges.

Dependencies

• Hard contract with closed feat(agent-readiness): publish OAuth Protected Resource Metadata (RFC 9728) #3312 (OAuth Protected Resource) — values must match. If you ever bump scopes_supported in oauth-protected-resource, bump it here in the same PR.
• Soft coordination with chore(mcp): audit MCP coverage — 39 seeded data sources not exposed to agents #3029 (MCP coverage) — when more tools/resources land, bump capabilities here.

Acceptance criteria

• curl -s https://worldmonitor.app/.well-known/mcp/server-card.json returns valid JSON.
• transport.endpoint responds to MCP initialize RPC.
• authentication.authorization_servers + resource + scopes match /.well-known/oauth-protected-resource byte-for-byte on those fields.
• isitagentready.com "MCP Server Card" check passes.

References

• Our server: api/mcp.ts (public at /mcp via vercel.json rewrite)
• Our OAuth: api/oauth/{authorize,token,register}.js, advertised at /.well-known/oauth-{protected-resource,authorization-server}
• SEP-1649 draft PR
• Skill: https://isitagentready.com/.well-known/agent-skills/mcp-server-card/SKILL.md