What & why

Makes the GitHub MCP Server discoverable via an MCP Server Card. Adds a new OSS-owned package pkg/http/servercard with:

• Go types matching the current v1 Server Card schema in modelcontextprotocol/experimental-ext-server-card (schema.json + docs/discovery.md).
• A constructor (NewServerCard) for the GitHub MCP Server's card, reusing the identity fields from the registry server.json so both documents describe the same server.
• A public, no-auth, read-only http.Handler that serves the card at the reserved /server-card location (public URL: transport URL + /server-card, e.g. https://api.githubcopilot.com/mcp/server-card).

Ownership: this package owns the Server Card implementation and all stable GitHub MCP identity/metadata, but the card is mounted and hosted only by the remote deployment (github/github-mcp-server-remote), which supplies the environment-specific remote URL and reuses this serving logic verbatim. The standalone OSS server does not advertise the card, so self-hosted binaries never falsely claim the dotcom remote.

Note: SEP-2127 is still open/in review — this tracks the current canonical v1 schema + discovery rules in the experimental extension repo, not an accepted core extension.

Card shape (remote-only, minimal)

The card is deliberately remote-only and minimal — it advertises identity + a single streamable-http remote and omits tools/resources/prompts and installable packages (those stay in the registry server.json). This is the exact JSON emitted for github.com:

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json",
  "name": "io.github.github/github-mcp-server",
  "version": "<build version>",
  "description": "Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.",
  "title": "GitHub",
  "websiteUrl": "https://github.com/github/github-mcp-server",
  "repository": { "url": "https://github.com/github/github-mcp-server", "source": "github", "id": "942771284" },
  "remotes": [
    { "type": "streamable-http", "url": "https://api.githubcopilot.com/mcp/" }
  ]
}

The name is locked to io.github.github/github-mcp-server, matching the registry server.json. It is the stable Server Card / registry server identity; the AI Catalog identifier is assigned independently and is not derived from the card name.

Serving behavior (per discovery.md)

• Media type application/mcp-server-card+json with RFC 9110 Accept negotiation, including quality values — an explicit q=0 on the most specific matching media range rejects with 406 Not Acceptable. Accept and If-None-Match are parsed as RFC 9110 list values across repeated header field-lines; Accept honors quoted commas and media-range parameters, while entity-tag lists split on quoted commas without backslash escaping (an opaque-tag treats a backslash literally).
• CORS — the mandated four headers, applied uniformly to GET/HEAD/OPTIONS/304:
  • Access-Control-Allow-Origin: *
  • Access-Control-Allow-Methods: GET
  • Access-Control-Allow-Headers: Content-Type, If-None-Match
  • Access-Control-Expose-Headers: ETag
• Cache-Control: public, max-age=3600.
• Vary: Accept, X-Forwarded-Host — appended (not set) so it composes with deployment-middleware values. Because the response is publicly cacheable and the multi-tenant remote derives its URL from the trusted X-Forwarded-Host, both are declared cache-key inputs so a shared cache cannot serve one tenant's card to another.
• Strong ETag (SHA-256 of the exact served body, quoted lowercase hex) with If-None-Match → 304 Not Modified (empty body). Weak comparison per RFC 9110. See upstream ETag proposal experimental-ext-server-card#33.

RegisterRoutes mounts the card at the single reserved /server-card path. A composition test guards that route against being shadowed by an MCP catch-all mount (r.Mount("/", h)), so the remote can register both on one router.

Reuse by the hosted/remote deployment

The hosted deployment is multi-tenant, so the remote URL (and therefore the card body + ETag) varies per request. To keep header/ETag logic byte-for-byte identical across OSS and the remote, the handler exposes:

• Config.RemoteURLFunc func(*http.Request) string — derive the per-request remote URL.
• ServeCard(w, r, card *ServerCard) — write the full response (Content-Type, CORS, Cache-Control, ETag, If-None-Match/304) for an already-built card.

Deliberately omitted (kept minimal)

• Installable packages — remote-only card; packages live in the registry server.json.
• supportedProtocolVersions — the go-sdk does not export the versions it negotiates, so it cannot be advertised accurately from the runtime; a hand-maintained list would drift.
• Icons — title / description / repository / websiteUrl are sufficient for discovery; icon data-URIs added code without contract value.
• Per-remote auth metadata — the hosted server advertises auth via OAuth protected-resource-metadata discovery; duplicating it on the card would risk drift and cannot capture every accepted mode. The v1 schema only requires type + url on a remote.

Validation

• go build ./..., go test -race ./... (full suite), ./script/lint (0 issues) — all green.
• Diff kept to 800 additions across 4 files (package + tests only); no vendored schema copy is checked in, and the standalone OSS server is untouched.
• Release-quality history: rebased onto current main (== v1.11.0) and squashed into a single commit.

Refs: github/copilot-mcp-core#1855 · epic github/copilot-mcp-core#1853