What a client looks for before it dials
discovery_reportFIRST CALL, needs nothing: {"name":"whoami","arguments":{}} — GET the documents an MCP client reads BEFORE the handshake and report what each one answered: /.well-known/oauth-protected-resource in BOTH forms — the root form everyone publishes and the RFC 9728 §3.1 insertion form a spec-following client actually requests for a resource served under a path — /.well-known/oauth-authorization-server, /.well-known/mcp, /.well-known/mcp.json, /mcp.json and /llms.txt. Each result carries the status, the verdict (served, missing, gated, soft-404 — a 200 carrying an HTML error page — or invalid JSON) and what a client does with that document. Makes one GET per document, 6 s each. Example: host='mcp.example.com' or host='https://mcp.example.com/mcp' (a path turns on the RFC 9728 insertion-form check) — or {} for the built-in fixture.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | A hostname, or the full endpoint URL. Give the full URL when your endpoint is served under a path: that is what the RFC 9728 §3.1 insertion form is derived from. |