MCP discovery endpoint completed the handshake but failed tool enumeration

What it detects

The MCP discovery file declares an endpoint that answered the initialize handshake, but a follow-up tools/list request against the same endpoint failed.

Why it matters

An agent that completes the handshake successfully has no way to know the same server will fail the very next call — it discovers the outage only by attempting it.

How to fix

- Find the endpoint declared in `/.well-known/mcp.json` (in the finding's `endpoints`) and reproduce the failure: POST a JSON-RPC `tools/list` immediately after a successful `initialize` handshake against it. - Check for session-handling bugs first — a dropped or unhonored `Mcp-Session-Id` header from the handshake response is the most common cause of a `tools/list` call failing right after a working `initialize`. - Also check for intermittent backend errors, rate limiting, or a `tools/list` handler that's mounted differently (or missing) compared to `initialize`. - Verify: run the same `initialize` → `tools/list` sequence a coding agent or MCP client would (forwarding the session id), and confirm `tools/list` now returns a `result.tools` array consistently, not just once.

References

• Model Context Protocol specification
• WAI-ARIA 1.2 (W3C)