Summary
SEP-2127's original Standards-Track text had a Denial of Service security item: servers SHOULD rate-limit discovery endpoints and clients SHOULD respect cache headers. While refactoring SEP-2127 to the Extensions Track (modelcontextprotocol#2893, tracked in #15), the normative security content moved into docs/discovery.md. Its Security Considerations cover information disclosure, CORS, and transport/MITM — but there is no DoS / rate-limiting guidance.
Proposed addition
Add a Denial of Service subsection to the Security Considerations, roughly:
- Servers SHOULD rate-limit Server Card retrieval endpoints.
- Clients SHOULD respect
Cache-Control headers and avoid unnecessary polling.
Exact wording can track whatever #12 (discovery mechanism) lands on, since the endpoint shape may change.
Context
The SEP-2127 charter keeps a one-line DoS bullet in its condensed Security summary, but the detailed/normative home for it is docs/discovery.md here.
Summary
SEP-2127's original Standards-Track text had a Denial of Service security item: servers SHOULD rate-limit discovery endpoints and clients SHOULD respect cache headers. While refactoring SEP-2127 to the Extensions Track (modelcontextprotocol#2893, tracked in #15), the normative security content moved into
docs/discovery.md. Its Security Considerations cover information disclosure, CORS, and transport/MITM — but there is no DoS / rate-limiting guidance.Proposed addition
Add a Denial of Service subsection to the Security Considerations, roughly:
Cache-Controlheaders and avoid unnecessary polling.Exact wording can track whatever #12 (discovery mechanism) lands on, since the endpoint shape may change.
Context
The SEP-2127 charter keeps a one-line DoS bullet in its condensed Security summary, but the detailed/normative home for it is
docs/discovery.mdhere.