Skip to content

docs(discovery): recommend ETag revalidation #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SamMorrowDrums merged 3 commits into from
Jul 24, 2026
+13 −2
Merged

docs(discovery): recommend ETag revalidation #46

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2d5f442
docs(discovery): recommend ETag revalidation
SamMorrowDrums Jul 20, 2026
9ec96c0
docs(discovery): scope ETags to Server Cards
SamMorrowDrums Jul 20, 2026
ae1353d
docs(discovery): link DoS guidance to ETags
SamMorrowDrums Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions docs/discovery.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,7 +245,8 @@ clients:
```
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Headers: Content-Type, If-None-Match
Access-Control-Expose-Headers: ETag
```

This is safe because Server Cards contain only public metadata and are read-only.
Expand All @@ -258,6 +259,15 @@ Server Card hosts SHOULD include caching headers to reduce unnecessary requests:
Cache-Control: public, max-age=3600
```

Hosts SHOULD also return an `ETag` response header. Entity tags are opaque HTTP validators; this
specification does not prescribe their form.

After receiving an `ETag`, clients SHOULD send its value in the `If-None-Match` header on
subsequent requests for the same resource. Hosts SHOULD honor `If-None-Match` and return
`304 Not Modified` when the selected representation has not changed. This complements
`Cache-Control`: fresh responses avoid requests, while entity-tag validation avoids transferring
an unchanged document after it becomes stale.

### Transport Security

Hosted Server Cards MUST be served over HTTPS (TLS 1.2 or later) in production. HTTP MAY
Expand All @@ -267,4 +277,5 @@ be used for local development only.

MCP Servers SHOULD implement rate limiting on their Server Card endpoint to prevent abuse.

MCP Clients SHOULD respect `Cache-Control` headers and avoid unnecessary polling.
MCP Clients SHOULD respect `Cache-Control` headers, use returned `ETag` validators as described
in [Caching](#caching), and avoid unnecessary polling.
Loading