Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions src/pages/.well-known/mcp/server-card.json.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
import type { APIRoute } from "astro";

export const prerender = true;

const serverCard = {
$schema: "https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",
version: "1.0",
protocolVersion: "2025-06-18",
serverInfo: {
name: "asynctalk",
title: "AsyncTalk",
version: "2.0.0",
},
description: "AsyncTalk 是一档中文 Web 开发播客。",
documentationUrl: "https://asynctalk.com",
transport: {
type: "streamable-http",
endpoint: "/mcp",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Point transport endpoint to a live MCP route

The server card advertises transport.endpoint as /mcp, but this change does not add any /mcp handler or rewrite in the repo (I checked with a repo-wide rg -uu -n "\bmcp\b|server-card", which only finds this new file). In deployments built from this code, clients that discover the card will attempt to connect to /mcp and receive a 404, so discovery now directs users to a non-functional MCP endpoint.

Useful? React with 👍 / 👎.

},
capabilities: {
tools: {},
prompts: {},
resources: {},
},
};

export const GET: APIRoute = () => {
return new Response(JSON.stringify(serverCard, null, 2), {
headers: {
"Access-Control-Allow-Origin": "*",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add full CORS preflight headers for discovery

The endpoint only returns Access-Control-Allow-Origin, but omits explicit Access-Control-Allow-Methods/Access-Control-Allow-Headers. Cross-origin browser clients that include non-simple discovery headers will trigger a preflight request, and without those allow-lists the browser can block access to the server card, undermining HTTP-based discovery in exactly the browser environments this endpoint is intended to support.

Useful? React with 👍 / 👎.

"Cache-Control": "public, max-age=3600",
"Content-Type": "application/json; charset=utf-8",
"X-Content-Type-Options": "nosniff",
},
});
};
Loading