MCP Server Self-Attestation Pack

Five MCP-developer checks, one signed attestation. Paste a target server's server.json, one example tool definition, and a handful of OAuth + security-hygiene flags. The pack runs a deterministic sub-score across five domains — tool-definition lint (JSON Schema 2020-12), server.json validation (2025-12-11 schema), OAuth 2.1 audit (RFC 9728 protected-resource metadata + RFC 8707 audience binding + PKCE), tool-poisoning scan, and ops readiness — then combines them into one composite A–F ship-readiness grade with an ordered remediation list and a single OpenChainGraph execution_hash receipt. Client-side. Zero PII.

⚠ A static-rule self-attestation over pasted artifacts — it does not connect to or probe a live server, and it does not cryptographically verify OAuth or signatures (no keys in the browser). Reference rules age; re-verify against the live MCP spec (modelcontextprotocol.io). Emitting a OpenChainGraph artifact does not by itself assert MCP-registry acceptance.

AP2 Export Chain Depth: 0 JSON Schema 2020-12 server.json · 2025-12-11 OAuth 2.1 · RFC 9728 / 8707 Tool-Poisoning Scan Zero PII infrastructure_mandate

ART-18 MCP Readiness Scorecard ART-28 Deployability Diagnostic

🔒 All checks run entirely in your browser. No data is transmitted. Do not paste live OAuth client secrets, signing keys, or production access tokens — use synthetic / redacted fixtures only.

Domain B — server.json document (required · 2025-12-11 schema)

server.json

MCP server manifest. Validated for: $schema URL, reverse-DNS name, version, and a remotes[] or packages[] transport block. Schema reference: 2025-12-11.

Domain A — example tool definition (required · JSON Schema 2020-12 inputSchema)

MCP tool definition

{ name, description, inputSchema, annotations? }. Linted for verb_noun naming, typed JSON Schema 2020-12 inputSchema (root type:object), per-parameter descriptions, and annotation presence. Also scanned for prompt-injection / tool-poisoning smells.

Domain C — OAuth 2.1 authorization flags

Exposes /.well-known/oauth-protected-resourceRFC 9728 — Protected Resource Metadata

Access-token aud validated against the canonical resourceRFC 8707 — Resource Indicators / audience binding

Authorization-code flow uses PKCEOAuth 2.1 — PKCE required for all public + confidential clients

All endpoints are HTTPS / TLS onlyMCP transport security — no cleartext authorization

Domain D / E — security hygiene & ops flags

readOnlyHint / destructiveHint annotations present where applicableMCP tool annotations — confirmation gating for destructive tools

No API keys, tokens, or secrets embedded in tool descriptionsTool-poisoning hygiene — descriptions are model-visible

Every tool input schema is fully typed (no untyped/any params)JSON Schema 2020-12 — typed params across the server

Composite Ship-Readiness

—

Per-Domain Scores

Check Detail

Ordered Remediation

OpenChainGraph Artifact · execution_hash

SHA-256: —

Computed client-side via WebCrypto SHA-256 over cgCanon({policy_parameters, output_payload}) (OpenChainGraph Standard v0.1 §6). Root node — chain_depth: 0.

Feeds → CRY-05 Audit-Trail Aggregator PTG-01 AP2 Prompt-Template Generator