---
title: "MCP Server Self-Attestation Pack"
method: POST
path: "/v1/tools/lint_mcp_server_conformance"
tags: ["TODO_TAGS_REVIEW"]
---

# MCP Server Self-Attestation Pack

`POST /v1/tools/lint_mcp_server_conformance`

## Request

- Base URL: `https://ainumbers.co`
- URL: `https://ainumbers.co/v1/tools/lint_mcp_server_conformance`
- Auth: none declared

Combines the five MCP-dev checks: tool-definition lint (JSON Schema 2020-12), server.json validation (2025-12-11 schema), OAuth 2.1 audit (RFC 9728 PRM, RFC 8707 audience), tool-poisoning scan, and ops/readiness, into one self-reported conformance lint: composite A-F ship-readiness grade plus per-domain scores and ordered remediation. This is an unsigned lint result, not a signed attestation. audit_signature.signatures is empty by design, as it is on every unsigned OpenChainGraph node. Dogfooding: the AINumbers server can lint itself. Formerly named attest_mcp_server; that name remains accepted permanently.

**Tool URL:** https://ainumbers.co/chaingraph/art-33-mcp-server-self-attestation-pack.html
**AP2/Policy Mandate export:** yes

## Request body

- object
  - `oauth_flags` unknown, required
  - `security_flags` unknown, required
  - `server_json` unknown, required
  - `tool_definition` unknown, required

## Response `200`

Successful tool execution result

- object
  - `composite_grade` string
  - `composite_score` integer
  - `fail_count` integer
  - `pass_count` integer
  - `per_domain_scores` object[]
    - `domain` string
    - `label` string
    - `score` integer
  - `remediation` object[]
    - `code` string
    - `domain` string
    - `note` string
    - `rank` integer
    - `severity` string
  - `warn_count` integer

---

[API](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite.md) · [All operations](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/llms.txt) · [OpenAPI document](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/revisions/b462e4f5bb28?raw)