Server cards are no longer served from a fixed .well-known path. Discovery
now goes through an AI Catalog (https://github.com/Agent-Card/ai-catalog)
published at /.well-known/ai-catalog.json, whose entries point at server
cards hosted anywhere:
- Add mcp.shared.experimental.ai_catalog: Pydantic models for the AI
Catalog CDDL schema (entries, host, publisher, trust manifest), enforcing
the url/data exclusivity and trust-manifest identity binding rules. The
transitional MCP Catalog (/.well-known/mcp/catalog.json) is a structural
subset and parses with the same models.
- Add mcp.server.experimental.ai_catalog: build catalog entries from server
cards (urn:mcp:server:<name>) and serve catalogs from the well-known path.
- Add discover_server_cards(): fetch a host's catalog (AI Catalog path with
fallback to the MCP Catalog path), then fetch or inline-validate every
MCP server entry. Non-http(s) card URLs from the catalog are rejected.
- Drop WELL_KNOWN_PATH and well_known_url; fetch_server_card now takes the
card URL directly and server_card_route/mount_server_card require an
explicit path.
Review fixes:
- Fix the version-range validator rejecting valid semver prereleases like
1.0.0-x; wildcard segments now only count in the release part, and bare
"x"/"*" are caught.
- Serve discovery documents with the CORS headers the spec requires
(MUST) and Cache-Control (SHOULD), exported as DISCOVERY_HEADERS.
- Restrict URL resolution to http(s) schemes to match its error message.
- Rename httpx_client to http_client and default to create_mcp_http_client()
(30s timeout) to match SDK conventions.
- Document that lenient ingestion defaults a missing $schema/specVersion,
diverging from the JSON Schema's required fields.
- Correct the mount_server_card docstring: mounting does not bypass auth
middleware.
- Add missing test package __init__.py files; assert response headers and
bodies in route tests; patch the SDK's own client factory instead of
httpx.AsyncClient.
David Soria Parra
dc49dd795a