generated: '2026-09-19'
method: probed
source: live GET of /.well-known/* on every apis.yml + OpenAPI servers[] host
note: 'Two real documents were returned. api.6sense.com serves RFC 8414 OAuth Authorization Server Metadata
  and RFC 9728 OAuth Protected Resource Metadata, both of which describe the 6sense remote MCP server
  at https://api.6sense.com/mcp (scopes_supported: mcp:use). No security.txt, api-catalog, ai-plugin.json
  or agent card is served on any host. 6sense.com itself sits behind a Cloudflare bot challenge and answered
  403 "Just a moment..." to every probe, so absence on the marketing host is unproven rather than measured.
  support.6sense.com is a Document360 SPA that answers a 200/404 HTML shell for arbitrary paths; those
  are recorded as misses, not documents.


  MCP-host OAuth discovery added 2026-09-19 (roadmap#321/#337): the harvest visits a provider''s primary
  hosts, and RFC 9728 protected-resource metadata lives on the MCP host, so these documents existed and
  were invisible to the scorer. Fetched live and validated on `resource`/`issuer`; one negative control
  per host.'
hosts:
- host: https://api.6sense.com
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: 6sense-oauth-authorization-server.json
    spec: RFC 8414
  - path: /.well-known/oauth-protected-resource/mcp
    status: 200
    content_type: application/json
    file: 6sense-oauth-protected-resource-mcp.json
    spec: RFC 9728
  - path: /.well-known/oauth-protected-resource
    status: 404
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://epsilon.6sense.com
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://scribe.6sense.com
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://6sense.com
  note: Cloudflare interstitial — every path returned 403 "Just a moment...". Not a measured absence.
  documents:
  - path: /.well-known/security.txt
    status: 403
  - path: /.well-known/agent-card.json
    status: 403
  - path: /.well-known/agent.json
    status: 403
  - path: /.well-known/api-catalog
    status: 403
- host: https://support.6sense.com
  note: Document360 SPA catch-all. Returns an HTML application shell for arbitrary /.well-known/* paths;
    treated as a miss per the soft-200 rule.
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
  - path: /.well-known/api-catalog
    status: 404
- host: https://auth.6sense.com
  documents:
  - path: /v1/apps/agentic/P32lusHUPY06hG8MJtqJnKEmq7hJ/MS3CTIZ4l7VZ4pFeraAIy18Y6wIVN/.well-known/oauth-authorization-server
    status: 200
    file: 6sense-auth-oauth-authorization-server.json
    bytes: 1887
  path_echo_control: passed
summary:
  documents_found: 2
  security_txt: false
  agent_card: false
  api_catalog: false
  openid_configuration: false
  oauth_metadata: true
x-mcp-probe:
  probed: '2026-09-19'
  issue: roadmap#321, roadmap#337
  documents:
  - host: https://auth.6sense.com
    path: /v1/apps/agentic/P32lusHUPY06hG8MJtqJnKEmq7hJ/MS3CTIZ4l7VZ4pFeraAIy18Y6wIVN/.well-known/oauth-authorization-server
    file: 6sense-auth-oauth-authorization-server.json
  validated_on: resource (RFC 9728) / issuer (RFC 8414, OIDC)
  negative_control: one per host; a 2xx JSON object at an impossible path discards the host