.well-known/mcp.json pattern and new security guidance solidified.

> impact

MCP ecosystem posts in February 2026 formalized .well-known/mcp.json as a default discovery endpoint so AI clients can automatically detect transports and capabilities, reducing manual configuration. In parallel, new security guidance and third-party tooling emphasized least-privilege tool permissions, authentication, and scanning for exposed MCP servers after incidents like ClawdBot.

> Try this now

try this

npm install express && node server.js to expose a minimal /.well-known/mcp.json endpoint for a local MCP server, then point Claude Code at http://localhost:3000 to verify automatic discovery.