MCP discovery declares a dead endpoint

What it detects

An MCP discovery file exists and declares an endpoint, but a live JSON-RPC initialize handshake against it fails.

Why it matters

A discovery file advertising a dead endpoint is worse than publishing none — an agent that trusts it wastes a request and treats the integration as broken rather than simply unavailable.

How to fix

- The MCP discovery file at `/.well-known/mcp.json` declares an endpoint that failed a live JSON-RPC `initialize` handshake (the scan's specific error is attached to the issue) — find the declared endpoint URL in the discovery file and reproduce the failure. - Check endpoint reachability first: the URL must resolve, serve HTTPS, and not sit behind an auth wall or WAF rule that blocks unauthenticated POSTs; then check the MCP server itself is running and mounted at that exact path (a moved/renamed mount is the most common cause of declared-but-dead). - Confirm the server answers the handshake: `curl -X POST <endpoint> -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'` should return a JSON-RPC response with a `result` object (JSON or SSE). - If the MCP server has been decommissioned, remove the discovery file (or the dead server entry) instead of leaving the stale declaration — agents treat a failed handshake as a broken integration, which is worse than advertising nothing. - Verify: re-run the `initialize` curl above and confirm a `result` (not an `error`) comes back, then re-scan to confirm the issue clears.

References

• Model Context Protocol specification
• WAI-ARIA 1.2 (W3C)