generated: '2026-08-14'
method: probed
source: live GET of /.well-known/* on every 1Lookup host
description: >-
  Well-known discovery surface for 1Lookup, re-probed 2026-08-14. THREE real documents are served, one
  of them new since the 2026-08-09 probe: app.1lookup.io serves the two OAuth metadata documents behind
  the hosted MCP connector, and www.1lookup.io now serves a machine-readable MCP server card at
  /.well-known/mcp/server-card.json (advertised in the provider's own llms.txt). Every other path
  misses. NOTE on false positives: app.1lookup.io previously answered 200 with an HTML shell for any
  unknown /.well-known/* path; it now 307s those to /login instead, which is a cleaner negative but
  still not a document. www.1lookup.io returns an honest 404, and the apex 1lookup.io 308-redirects to
  www. Only application/json bodies that parsed are treated as hits.
hosts:
  - host: https://www.1lookup.io
    documents:
      - path: /.well-known/mcp/server-card.json
        status: 200
        content_type: application/json
        parsed: true
        file: 1lookup-mcp-server-card.json
        note: >-
          Provider-published MCP server card — serverInfo, transport (streamable HTTP), OAuth 2.1
          authentication with both metadata URLs, and the five tools with descriptions. Not an A2A
          agent card and not an RFC-registered path; it is a vendor discovery document referenced from
          https://www.1lookup.io/llms.txt.
      - {path: /.well-known/security.txt, status: 404}
      - {path: /.well-known/openid-configuration, status: 404}
      - {path: /.well-known/oauth-authorization-server, status: 404}
      - {path: /.well-known/oauth-protected-resource, status: 404}
      - {path: /.well-known/api-catalog, status: 404}
      - {path: /.well-known/ai-plugin.json, status: 404}
      - {path: /.well-known/agent-card.json, status: 404}
      - {path: /.well-known/agent.json, status: 404}
  - host: https://app.1lookup.io
    documents:
      - path: /.well-known/oauth-authorization-server   # RFC 8414
        status: 200
        content_type: application/json
        parsed: true
        file: 1lookup-oauth-authorization-server.json
      - path: /.well-known/oauth-protected-resource     # RFC 9728
        status: 200
        content_type: application/json
        parsed: true
        file: 1lookup-oauth-protected-resource.json
      - {path: /.well-known/security.txt, status: 307, redirect: https://app.1lookup.io/login, parsed: false}
      - {path: /.well-known/openid-configuration, status: 307, redirect: https://app.1lookup.io/login, parsed: false}
      - {path: /.well-known/api-catalog, status: 307, redirect: https://app.1lookup.io/login, parsed: false}
      - {path: /.well-known/ai-plugin.json, status: 307, redirect: https://app.1lookup.io/login, parsed: false}
      - {path: /.well-known/agent-card.json, status: 307, redirect: https://app.1lookup.io/login, parsed: false, note: 'NOT an A2A agent card — auth redirect'}
      - {path: /.well-known/agent.json, status: 307, redirect: https://app.1lookup.io/login, parsed: false}
      - {path: /.well-known/mcp.json, status: 307, redirect: https://app.1lookup.io/login, parsed: false}
      - {path: /.well-known/mcp/server-card.json, status: 307, redirect: https://app.1lookup.io/login, parsed: false, note: 'The card is served from www, not app'}
  - host: https://1lookup.io
    note: Apex 308-redirects every /.well-known/* path to the www host; no documents of its own.
    documents:
      - {path: /.well-known/security.txt, status: 308, redirect: 'https://www.1lookup.io/.well-known/security.txt'}
      - {path: /.well-known/agent-card.json, status: 308, redirect: 'https://www.1lookup.io/.well-known/agent-card.json'}
      - {path: /.well-known/agent.json, status: 308, redirect: 'https://www.1lookup.io/.well-known/agent.json'}
      - {path: /.well-known/mcp/server-card.json, status: 308, redirect: 'https://www.1lookup.io/.well-known/mcp/server-card.json'}
summary:
  security_txt: false
  openid_configuration: false
  oauth_authorization_server: true
  oauth_protected_resource: true
  mcp_server_card: true
  api_catalog: false
  agent_card: false
changes_since_last_probe:
  - 'NEW: /.well-known/mcp/server-card.json on www.1lookup.io (200, application/json) — was not present on 2026-08-09.'
  - 'app.1lookup.io stopped soft-200ing unknown /.well-known/* paths; they now 307 to /login.'
x-evidence:
  fetched: '2026-08-14'
  probes: 31
  hits: 3