generated: '2026-09-10'
method: probed
source: live probes of https://www.aerofarms.com/.well-known/* and https://aerofarms.com/.well-known/*
hit_count: 2
note: >-
  Two real RFC 8615 discovery documents are served, and both belong to the Model Context Protocol
  server this site runs at /wp-json/mcp/mcp-oauth-server. Both paths answer 301 without a trailing
  slash and 200 with one, so the saved status is the status of the followed request; the bodies are
  saved verbatim. Everything else 404s. Note the shape of the misses: www.aerofarms.com returns its
  full HTML 404 page (264KB) with a real 404 status for unknown /.well-known/* paths, so these are
  honest absences rather than a soft-200 shell. /.well-known/security.txt is the one exception — it
  is answered by the edge with a short plain 404, not by WordPress. No SecurityTxt pointer is
  emitted, because AeroFarms serves no security.txt. Only the WellKnown pointer is emitted, on the
  strength of the two OAuth documents that really are served.
hosts:
- host: www.aerofarms.com
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: aerofarms-oauth-authorization-server.json
    note: >-
      RFC 8414 authorization-server metadata. Declares issuer https://www.aerofarms.com, the
      /oauth/authorize, /oauth/token and /oauth/revoke endpoints, response_types code,
      authorization_code + refresh_token grants, PKCE S256 required, a single scope "mcp",
      token_endpoint_auth_methods none (public clients), and client_id metadata documents.
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
    file: aerofarms-oauth-protected-resource.json
    note: >-
      RFC 9728 protected-resource metadata. Names the protected resource
      https://www.aerofarms.com/wp-json/mcp/mcp-oauth-server, points at this same host as its
      authorization server, bearer via header, scope "mcp". This is the document the MCP endpoint's
      own WWW-Authenticate challenge references.
  - path: /.well-known/security.txt
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/openid-configuration
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/api-catalog
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/ai-plugin.json
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/agent-card.json
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/agent.json
    status: 404
    content_type: text/html
    file: null
- host: aerofarms.com
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: aerofarms-oauth-authorization-server.json
    note: Apex serves the same document as www; the issuer inside it is the www host.
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
    file: aerofarms-oauth-protected-resource.json
    note: Apex serves the same document as www.
  - path: /.well-known/security.txt
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/openid-configuration
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/api-catalog
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/ai-plugin.json
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/agent-card.json
    status: 404
    content_type: text/html
    file: null
  - path: /.well-known/agent.json
    status: 404
    content_type: text/html
    file: null
related_probes:
- path: /llms.txt
  status: 200
  note: >-
    Provider-published llms.txt, generated by Yoast SEO v28.4, saved verbatim to
    llms/aerofarms-llms.txt.
- path: /robots.txt
  status: 200
  note: >-
    Disallows /wp-admin/, /wp-content/uploads/wpforms/, /ufaq/*, /es/, /zh-hans/ and /setup/, and
    names sitemap_index.xml. Nothing probed in this pass was disallowed — the REST routes under
    /wp-json/ are not covered by any rule.
- path: /sitemap_index.xml
  status: 200
  note: Yoast sitemap index.
- path: /openapi.json
  status: 404
- path: /swagger.json
  status: 404
- path: /apis.json
  status: 404
- path: /graphql
  status: 404
- path: /feed/
  status: 200
  note: >-
    A soft hit, not a feed — /feed/ returns the site homepage HTML (503,763 bytes, identical to /),
    so no RSS/Atom pointer is emitted.
subdomains_checked:
- {host: api.aerofarms.com, dns: NXDOMAIN}
- {host: docs.aerofarms.com, dns: NXDOMAIN}
- {host: developers.aerofarms.com, dns: NXDOMAIN}