generated: '2026-07-17'
method: derived
source: openapi/agentcard-openapi-original.json + well-known/agentcard-oauth-authorization-server.json + https://docs.agentcard.sh
standards:
- id: oauth2
  conforms: true
  evidence: Platform tokens minted via OAuth2 client credentials (RFC 6749 §4.4, POST /api/v2/oauth/token). OAuthError uses RFC 6749 §5.2 shape.
- id: oauth2-pkce
  conforms: true
  evidence: End-user "Connect with Agentcard" enforces OAuth 2.1 + PKCE S256 (code_challenge_methods_supported=[S256]) on every client, confidential included.
- id: rfc8414-oauth-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200 with issuer/authorization/token/registration/revocation endpoints.
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: /.well-known/oauth-protected-resource returns 200 (resource + authorization_servers).
- id: rfc7591-dynamic-client-registration
  conforms: true
  evidence: registration_endpoint https://mcp.agentcard.sh/register advertised in AS metadata.
- id: rfc9727-api-catalog
  conforms: true
  evidence: /.well-known/api-catalog returns a linkset (service-desc/service-doc/status) for the API and MCP anchors.
- id: mcp
  conforms: true
  evidence: Hosted MCP server over Streamable HTTP with published server-card and OAuth-protected resource.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404; OAuth is used for authorization, not OIDC identity.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom stable-code envelope ({error:{code,message,docs}}), not application/problem+json.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt found on any host (404).
- id: pci-dss
  conforms: unknown
  evidence: Card issuer over Visa; no public certification claim found. Card credentials are said never to touch the integrator's servers.