MCPP-PRM08: PRM resource has a fragment or query

Family	Protected Resource Metadata (RFC 9728)
Default severity	high
Confidence	high
Mode	passive (default scan)
Spec revisions	2025-06-18 and later

Why it matters

The resource identifier becomes the RFC 8707 resource parameter, which MUST NOT contain a fragment and SHOULD NOT contain a query.

Remediation

Use a resource URL without #fragment and without ?query.

References

• RFC 8707 Resource Indicators
• RFC 9728 Protected Resource Metadata

Suppressing

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-PRM08"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31