MCP server identity declared vs. runtime mismatch
SERVER-CARD-005 · v1.0
What it detects
The identity a server declares for itself in the MCP discovery file doesn't match the serverInfo.name the live initialize handshake actually reports.
Why it matters
Agents that use the declared identity to decide whether to trust or connect to a server are being told something the runtime server itself contradicts.
How to fix
- Compare the server name declared as the `mcpServers` key in `/.well-known/mcp.json` against the `serverInfo.name` your MCP server actually returns from a live `initialize` call. - Reconcile them: rename the discovery file's key to match what the server reports, or update the server's `serverInfo.name` to match the discovery file — whichever is the actual current identity. - If this endpoint now serves a different or renamed server than when the discovery file was authored, update the discovery file's declaration rather than leaving a stale identity in place. - Verify: `curl -X POST` an `initialize` request against the declared endpoint, confirm `result.serverInfo.name` matches the `mcpServers` key naming it in `/.well-known/mcp.json`.
References
Last reviewed: 2026-09-01 · rule v1.0