mediumMCP_CANONICAL_HOST_MISMATCH
MCP manifest points at a different hostname
Expected echo.platphormnews.com; observed api.platphormnews.com.
GET https://echo.platphormnews.com/.well-known/mcp.json
HTTP 200
Content-Type: application/json
199 ms
Digest: sha256:8d5620aa459cc6484695af3ba57392edca03ef5e99b51d2036c74f776181fb9e
Preview: {"protocolVersion":"2024-11-05","serverInfo":{"name":"PlatPhorm API MCP Bridge","version":"0.4.0"},"capabilities":{"tools":{"listChanged":false},"resources":{"subscribe":false,"listChanged":false},"prompts":{"listChanged":false}},"usage":{"endpoint":"/api/mcp","transport":"HTTP JSON-RPC 2.0","publicRead":true,"protectedActionsRequire":["Authorization: [REDACTED] $PLATPHORM_API_KEY","X-PlatPhorm-API-Key"]},"service":"api","name":"PlatPhorm API MCP","endpoint":"https://api.platphormnews.com/api/mcp","discoveryUrl":"https://api.platphormnews.com/.well-known/mcp.json","publicRead":true,"toolsMayMutate":false,"protectedActionsRequire":"PLATPHORM_API_KEY"}infoUNDECLARED_CAPABILITY_OBSERVED
Undeclared trust capability was observed
https://echo.platphormnews.com/.well-known/trust.json
GET https://echo.platphormnews.com/.well-known/trust.json
HTTP 200
Content-Type: application/json
46 ms
Digest: sha256:acb2f05f786052bfa44ad2b591338e62d5385b9562a684e57a0132eef7a70eb9
Preview: {"service":"api","name":"PlatPhorm API","url":"https://api.platphormnews.com","auth":{"platformKey":"PLATPHORM_API_KEY","acceptedHeaders":["Authorization: [REDACTED] $PLATPHORM_API_KEY","X-PlatPhorm-API-Key: [REDACTED],"publicReadAccess":["homepage","API catalog","service catalog","products","OpenAPI registry","schema registry","event/webhook registry","MCP mappings","governance","parity","health","docs","recipes","clients","discovery files","well-known policy","read-only MCP introspection"],"protectedActions":["registry mutation","OpenAPI import/write/update","schema write/update/delete","protected route proxying","downstream protected API/MCP calls","report generation with sensitive data","SDK publishing","webhook triggering","admin sync jobs","private audit logs","private trace views","token/key issuing or rotation"],"trustedDomains":["*.platphormnews.com"],"runtimeModes":["catalog_only","public_proxy","protected_proxy","validation_only","degraded","maintenance"],"dataExposureBoundaries":{"public":["service catalog","operation catalog","schemas","OpenAPI metadata","public docs","health summaries","governance/parity scores","recipes","redacted trace metadata"],"protected":["registry mutations","private audit logs","protected downstream responses","provider credentials","unredacted JA4 digest metadata","private traces"]},"requiredTrustPolicyLine":"Web dashboard, public-safe discovery, browser-based operations, trusted-domain discovery, standard route compliance, Vercel metadata capture, trace inspection, and agentic workflow discovery are intentionally supported for public read-only debugging and operator workflows. Mutating, administrative, ingestion, replay, fork, remediation, deployment, sync, test-triggering, reporting, and write actions require PLATPHORM_API_KEY."}