{"slug": "scovant-core-0-26-0-mcp-endpoint-detection-that-reads-real-evidence", "title": "Scovant Core 0.26.0: MCP endpoint detection that reads real evidence", "summary": "Scovant released Core 0.26.0, which replaces its naive MCP endpoint check with evidence-based detection after measuring 8,523 sites and finding that a 200 response at /.well-known/mcp.json rarely indicated a real server. The scanner now validates discovery files, recognizes server cards by structure, follows /.well-known/ai-catalog.json to fetch up to three listed cards, and reports 'not measured' on timeouts, 429s or 5xx errors rather than a false negative. The Technical Readiness model moves to R2.1@7b46d2ed7f8b and the MCP_ENDPOINT_ABSENT rule to version 2.0, with at most four extra passive GET requests per scan.", "body_md": "A scanner that asks \"does this site expose an MCP server?\" usually starts at\n\none URL: `/.well-known/mcp.json`. Many sites answer that URL with *something*: a\n\ncatch-all page, a JSON error, a redirect to the homepage. Until this release,\n\nScovant Core counted an HTTP 200 there as a sign of an endpoint. That was wrong,\n\nso before changing it we measured how wrong.\n\nIn a corpus of 8,523 sites:\n\n`/.well-known/mcp.json`\n`/.well-known/ai-catalog.json`)\nSo the one place everyone looks was, in practice, never the place a real server\n\nwas described, while the sites that *did* describe an MCP server mostly did it\n\nthrough a catalog the old check never read.\n\n**A discovery file has to be one.** A 200 at `/.well-known/mcp.json` that is an\n\nHTML page, or JSON without an `mcpServers` server, no longer counts as an\n\nendpoint. The finding now says what was served instead, so the fix is obvious.\n\n**Server cards are recognised, not assumed.** A card at the well-known card\n\npaths counts only when it looks like a server card: a JSON object with a\n\nnon-empty `name` and a `remotes` list, a `version` or a `$schema`. A JSON error\n\npage at those paths is no card.\n\n**The AI Catalog is followed.** Core reads `/.well-known/ai-catalog.json` and\n\nfetches up to three server cards it lists — https and public addresses only,\n\nfollowing up to five redirects on each. A card found that way counts as an MCP\n\nsurface, so a site that publishes its server through a catalog stops getting a\n\nfalse \"no MCP endpoint\" finding.\n\n**No answer is not a \"no\".** If the catalog or a listed card times out, answers\n\n429 or 5xx, or is cut off at our read limit before it parses, the rule reports\n\n*not measured* instead of a finding. Our failure to read a document is never\n\nevidence about the site — the same rule Core has applied to every other\n\ndocument since its first release.\n\nAt most four more requests per scan (the catalog and up to three cards), plus\n\nany redirect hops. Core stays passive: ordinary GETs, no authentication, and it\n\nnever calls an MCP endpoint or invokes a tool it discovers.\n\nThe Technical Readiness model id moves to `R2.1@7b46d2ed7f8b`, and the rule\n\nbehind this check, `MCP_ENDPOINT_ABSENT`, moves to rule version 2.0. Results\n\nproduced before and after the release carry different model ids, so a change\n\nin a site's result can always be told apart from a change in how we measure.\n\nEvery model change is listed in the\n\n[methodology changelog](https://scovant.com/scoring/changelog).\n\n```\npip install -U scovant-core\nuvx --from scovant-core scovant scan https://example.com\nnpx @scovant/core scan https://example.com\n```\n\nThe GitHub Action `Scovant/scovant-core@v0` picks up 0.26.0 automatically; pin\n\n`@v0.26.0` for an exact version. The full list of changes is in the\n\n[changelog](https://github.com/Scovant/scovant-core/blob/main/CHANGELOG.md).", "url": "https://wpnews.pro/news/scovant-core-0-26-0-mcp-endpoint-detection-that-reads-real-evidence", "canonical_source": "https://dev.to/scovant/scovant-core-0260-mcp-endpoint-detection-that-reads-real-evidence-30ln", "published_at": "2026-11-12 18:48:47+00:00", "updated_at": "2026-11-12 18:52:51.238667+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "developer-tools", "ai-tools"], "entities": ["Scovant", "Scovant Core", "MCP", "AI Catalog"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/scovant-core-0-26-0-mcp-endpoint-detection-that-reads-real-evidence", "markdown": "https://wpnews.pro/news/scovant-core-0-26-0-mcp-endpoint-detection-that-reads-real-evidence.md", "text": "https://wpnews.pro/news/scovant-core-0-26-0-mcp-endpoint-detection-that-reads-real-evidence.txt", "jsonld": "https://wpnews.pro/news/scovant-core-0-26-0-mcp-endpoint-detection-that-reads-real-evidence.jsonld"}}