MCPP-PRM02: Protected Resource Metadata malformed¶


Family	Protected Resource Metadata (RFC 9728)
Default severity	`medium`
Confidence	`high`
Mode	passive (default scan)
Spec revisions	2025-06-18 and later

Why it matters¶

RFC 9728 §3.2: a successful response MUST be 200 with an application/json JSON object, and parameters with zero values MUST be omitted. Clients reject anything else.

Remediation¶

Return 200 OK, Content-Type: application/json, a JSON object, and omit empty arrays.

References¶

RFC 9728 Protected Resource Metadata

Suppressing¶

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-PRM02"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31