Resources use valid URI templates with mimeType set
Why it matters
Clients use resource URIs as stable identifiers to fetch, cache, and subscribe to server data. A bare string like config or logs is not a URI — it breaks RFC 6570 template parsing and prevents clients from constructing valid resource reads. Without mimeType, clients cannot determine whether to render content as markdown, JSON, or binary, which causes display failures or silently mangled output. These are fundamental contract violations that break resource discovery for any client following the MCP spec.
Severity rationale
High because invalid URI templates and missing mimeType fields cause resource reads to fail at the protocol level, making all registered resources inaccessible to compliant clients.
Remediation
Replace bare strings with proper URI templates (RFC 6570) and always set mimeType in the resource options.
// src/resources/index.ts
server.resource(
'app-config',
'config://app/settings',
{ mimeType: 'application/json', description: 'Current application configuration as JSON' },
async (uri) => ({
contents: [{ uri: uri.href, mimeType: 'application/json', text: JSON.stringify(config) }]
})
)
// Parameterized resource — descriptive template variable
server.resource(
'log-file',
new ResourceTemplate('logs://app/{date}', { list: undefined }),
{ mimeType: 'text/plain', description: 'Application log for a date in YYYY-MM-DD format' },
async (uri, { date }) => ({
contents: [{ uri: uri.href, mimeType: 'text/plain', text: await readLog(date) }]
})
)
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the MCP Server Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · mcp-spec-resources — MCP Specification — Resources and URI templates (RFC 6570)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mcp-server·automated