generated: '2026-09-04' method: searched source: probes of the live surface on 2026-09-04 + https://anew.page/llms.txt + openapi/anew-openapi.json summary: >- anew's conformance profile is almost entirely agent-interop rather than enterprise-compliance. It implements the discovery and description standards of the agent ecosystem broadly and correctly — MCP, A2A, Agent Skills, RFC 9727, llms.txt, agents.txt, HTTP Message Signatures — and implements none of the identity, security-certification or regulated-data standards, which is consistent for an unauthenticated service that stores nothing. conformance: - id: openapi-3.1 name: OpenAPI 3.1.1 conforms: true evidence: https://anew.page/openapi.json note: Parses as OpenAPI 3.1.1 with 4 operations, all with operationId, summary, description, tags and 2xx/4xx responses. - id: rfc9727 name: RFC 9727 API Catalog conforms: true evidence: https://anew.page/.well-known/api-catalog note: >- Served with content-type application/linkset+json and the RFC 9727 profile parameter. A correctly anchored linkset with service-desc and service-doc relations per interface — not merely a JSON file at the path. - id: rfc9421 name: RFC 9421 HTTP Message Signatures (key directory) conforms: true evidence: https://anew.page/.well-known/http-message-signatures-directory note: >- Served with content-type application/http-message-signatures-directory+json, carrying one Ed25519 JWK. The directory is published; signature verification behaviour on requests was not exercised. - id: rfc9745 name: RFC 9745 Deprecation header conforms: true evidence: https://anew.page/llms.txt note: >- Policy published, not yet exercised — nothing is deprecated today. Committed as the wire signal when something is, alongside Sunset and a Link rel=deprecation. - id: rfc8594 name: RFC 8594 Sunset header conforms: true evidence: https://anew.page/llms.txt note: Committed with a minimum 90-day gap after the Deprecation date. - id: ratelimit-headers name: draft-ietf-httpapi-ratelimit-headers-11 conforms: true evidence: https://anew.page/write note: 'Observed live on a 200: RateLimit-Policy: "api";q=300;w=60. RateLimit with r=0 and Retry-After documented on 429.' - id: rfc9457 name: RFC 9457 Problem Details conforms: false evidence: openapi/anew-openapi.json note: >- Errors use a bespoke envelope { "error": { code, message, hint?, details? } } served as application/json, not application/problem+json. Functionally close — a closed, stable, documented code enum — but not the standard. - id: mcp name: Model Context Protocol conforms: true versions: ['2026-07-28', '2025-11-25'] evidence: https://anew.page/mcp note: >- Live tools/list answered 200 anonymously. Implements tools, prompts and resources, the io.modelcontextprotocol/ui extension, spec-required Origin validation, and -32022 on an unsupported revision. - id: mcp-server-registry name: MCP server.json registry schema 2025-12-11 conforms: true evidence: https://anew.page/.well-known/mcp/server-card.json - id: a2a name: Agent2Agent (A2A) 1.0 conforms: partial evidence: https://anew.page/.well-known/agent-card.json note: >- Card served at the canonical path with the application/a2a+json media type and a live JSON-RPC endpoint, but no top-level protocolVersion. Graded near-conformant — see a2a/anew-a2a.yml. - id: agent-skills name: Agent Skills discovery 0.2.0 conforms: true evidence: https://anew.page/.well-known/agent-skills/index.json note: >- Declares $schema https://schemas.agentskills.io/discovery/0.2.0/schema.json and publishes a sha256 digest for the skill. The digest was independently verified to match the served SKILL.md exactly. - id: llms-txt name: llms.txt conforms: true evidence: https://anew.page/llms.txt note: Also served at /AGENTS.md and /llms-full.txt, byte-identical. - id: agents-txt name: agents.txt / agents.json 1.0 conforms: true evidence: https://anew.page/agents.json note: Declares $schema https://agents-txt.com/schema/agents-json/v1.0.json. - id: ai-resource-discovery name: AI resource discovery catalog (specVersion 1.0) conforms: true evidence: https://anew.page/.well-known/ai-catalog.json note: 'Four indexed entries with urn:air: identifiers and representative queries.' - id: did-web name: did:web conforms: partial evidence: https://anew.page/.well-known/ai-catalog.json note: >- The ai-catalog declares the host identifier did:web:anew.page, but no DID document is served at /.well-known/did.json, so the identifier is asserted rather than resolvable. - id: content-signals name: Content Signals (contentsignals.org) conforms: true evidence: https://anew.page/robots.txt note: >- Site default search=no, ai-train=no, ai-input=yes, with explicit per-path grants opening the machine-readable documents to all three. Framed as an express reservation of rights under Article 4 of EU Directive 2019/790. - id: webmcp name: WebMCP (in-page tools) conforms: true evidence: https://anew.page/agents.json note: Permissions-Policy tools=self shipped on every anew surface, including rendered user pages. - id: cors name: CORS conforms: true evidence: https://anew.page/write note: >- Observed live — Access-Control-Allow-Origin *, preflight answered, measurement headers named in Access-Control-Expose-Headers so a foreign origin can read them. - id: sitemaps name: sitemaps.org 0.9 conforms: true evidence: https://anew.page/sitemap.xml - id: oauth2 name: OAuth 2.0 conforms: false evidence: https://anew.page/.well-known/oauth-authorization-server note: 404. No authorization server — the API is unauthenticated by design. - id: oidc name: OpenID Connect conforms: false evidence: https://anew.page/.well-known/openid-configuration note: 404. No identity layer. - id: asyncapi name: AsyncAPI conforms: false evidence: https://anew.page/llms.txt note: >- Not applicable rather than missing. The provider states "Webhooks: none. Nothing is stored and there are no events, so there is nothing to subscribe to and no callback is ever requested." domain_standard: market: agent-interoperability and machine-readable web publishing declared_in_contract: true standards: - MCP (2026-07-28 and 2025-11-25) — live tools/list, prompts and resources, plus the UI extension - A2A 1.0 — agent card at the canonical path, live JSON-RPC endpoint - Agent Skills discovery 0.2.0 — digest-verified skill index - RFC 9727 API Catalog — profile-tagged linkset - llms.txt / AGENTS.md / agents.txt / agents.json - AI resource discovery catalog (ai-catalog.json) - RFC 9421 HTTP Message Signatures key directory - WebMCP in-page tool registration evidence: >- These are declared in the machine-readable surface itself, not claimed on a marketing page: the schemas are named inline ($schema in agent-skills/index.json, agents.json and the MCP server card; the RFC 9727 profile parameter in the api-catalog content-type; protocolVersions in mcp.json), and every one of the documents was fetched and parsed on 2026-09-04. assessment: >- For a service whose market is agents calling a web API, this is close to the full applicable standard set. The two gaps against that market are RFC 9457 problem details and a resolvable DID document. compliance_certifications: published: [] note: >- No SOC 2, ISO 27001, PCI, HIPAA, FedRAMP or GDPR certification is claimed, and no trust center exists. Consistent with the service model — no account, no cookie, no profile, nothing retained. The published privacy statement is a plain-language section of LICENSE.md, not an audited program. privacy_statement: https://github.com/round/anew.page/blob/main/LICENSE.md regulatory_regime: none regulatory_note: >- No regulated data class is handled. The service processes only the document a caller submits, retains nothing, and has no identity, payment or health surface.