Define security schemes with their required fields

Named security schemes are non-empty and each scheme has a type and the fields that type requires, such as OAuth flows with their URLs and scopes. Unknown properties are rejected.

Requirement

securitySchemes is a non-empty map of Security Scheme Objects that contain their type-specific required fields and only defined properties.

Details

Rule ID: mcpdesc.security-scheme.members
Owner: mcpdesc
Surface: Security Scheme
Kind: structural
Requirement level: must
Protocol versions: independent of the MCP protocol version
Document schema locations: #/$defs/securitySchemeMap, #/$defs/securityScheme, #/$defs/oauthFlows, #/$defs/oauthFlow
Status: internal · Enforcement: internal

Required by

• MCP Description 0.9.0, Sections 7.1 and 7.2
  • 7. Security: req-security-scheme-fields
  • 7. Security: req-security-schemes-map
  • 7. Security: req-oauth-flows-fields
  • 15. Serialization: req-serialization-value-formats

Examples

Invalid example

Source: expected-invalid/empty-ordinary-root-collections.json · Selected: /securitySchemes

{}

Invalid example

Source: expected-invalid/invalid-security-scheme-name.json · Selected: /securitySchemes

{
  "invalid name": {
    "type": "http",
    "scheme": "bearer"
  }
}

Invalid example

Source: expected-invalid/discriminated-union-members.json · Selected: /securitySchemes/token

{
  "type": "http",
  "shceme": "bearer"
}

Rule Source Code

document.yaml at immutable tag v0.9.0-rc.3.