← Rule catalog
mediumexperimentalactionability

MCP server identity declared vs. runtime mismatch

SERVER-CARD-005 · v1.0

What it detects

The identity a server declares for itself in the MCP discovery file doesn't match the serverInfo.name the live initialize handshake actually reports.

Why it matters

Agents that use the declared identity to decide whether to trust or connect to a server are being told something the runtime server itself contradicts.

How to fix

- Compare the server name declared as the `mcpServers` key in `/.well-known/mcp.json` against the `serverInfo.name` your MCP server actually returns from a live `initialize` call. - Reconcile them: rename the discovery file's key to match what the server reports, or update the server's `serverInfo.name` to match the discovery file — whichever is the actual current identity. - If this endpoint now serves a different or renamed server than when the discovery file was authored, update the discovery file's declaration rather than leaving a stale identity in place. - Verify: `curl -X POST` an `initialize` request against the declared endpoint, confirm `result.serverInfo.name` matches the `mcpServers` key naming it in `/.well-known/mcp.json`.

References

Last reviewed: 2026-09-01 · rule v1.0