Why It Matters

Undefined placeholders in server.json remote URLs break portability and can push registry consumers into runtime failures or ad hoc string substitution behavior.

What Triggers

SEC320 applies to server.json remotes[] URL templates and triggers when a placeholder in the URL is not defined under the same remote entry's variables object.

Example that triggers:

{
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://{tenant_id}.example.com/mcp"
    }
  ]
}

Example that stays clean:

{
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://{tenant_id}.example.com/mcp",
      "variables": {
        "tenant_id": { "description": "Tenant subdomain", "isSecret": false }
      }
    }
  ]
}

False Positives

This is a structural consistency check over parsed placeholders and variable keys. If the placeholder is genuinely meant to be provided elsewhere, the safer pattern is still to declare it explicitly under the same remote entry.

Remediation

Define every URL placeholder under remotes[].variables or remove the unresolved placeholder from the remote URL.