Repository navigation
feat: serve an MCP server card at /.well-known/mcp/server-card.json - #169
Merged
Merged
Conversation
Agent-readiness scanners and registries look for a SEP-1649 card at the server origin (Ora probes <server URL>/server-card) to show a branded listing before connecting. mcp.appwrite.io served none, so it was reported with no icon. Serve the card, with the registry name, a schema-length description, the existing favicon and the remote URL, at both paths.
🟢 Tier S · Ready to mergeAdds public MCP server-card endpoints at Latest changes: The newest commits update the card to SEP-2127 and add the supported protocol versions advertised by the MCP types package, with an assertion for the 2025-11-25 version.
📂 Walkthrough · 3
Reviewed the commits since |
![appwrite[bot]](https://avatars.githubusercontent.com/in/325556?s=60&v=4){kind=small}
appwrite
Bot
dismissed
their stale review
November 11, 2026 14:32
The findings that requested changes are resolved. See the summary comment for what is still open.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Ora's agent-readiness scan flags
registry-branding: it looks for a server card at<server URL>/server-cardto read the title, icon and description, andmcp.appwrite.ioserves none (/server-cardand/.well-known/mcp/server-card.jsonboth 404).This serves a SEP-1649 server card at both paths, without auth and with CORS
*:name:io.github.appwrite/mcp(the MCP Registry name, nowSERVER_REGISTRY_NAME)title,version,websiteUrl,repositorydescription: the 98-character registry summary (the card schema caps it at 100;serverInfo.descriptionis 192)icons: the existing/favicon.svg, built fromMCP_PUBLIC_URLremotes: the canonical Streamable-HTTP resource (<MCP_PUBLIC_URL>/)Checks
ruff,black --check,pyright: cleanToolsFlow.test_server_card_describes_the_server_without_authhits both paths on the real app and asserts status, CORS, name, title, description length, icon and remote URL;test_tools.pypasses (10 tests)Not in this PR
Ora also reports
mcp-oauth-metadata/mcp-pkce-s256/mcp-auth-mechanismas missing. The metadata exists (S256 PKCE and CIMD are advertised), but the protected-resource metadata names the issuerhttps://fra.cloud.appwrite.io/v1/oauth2/console, and RFC 8414 §3.1 path insertion (https://fra.cloud.appwrite.io/.well-known/oauth-authorization-server/v1/oauth2/console) returns 404. That route belongs on the Appwrite server, not here.Related: appwrite-labs/cloud#6667