generated: '2026-07-18'
method: searched
sources:
  - openapi/brainfish-public-api-openapi-original.json
  - well-known/brainfish-mcp-oauth-authorization-server.json
  - https://trust.brainfi.sh/
standards:
  - id: oauth2.1
    conforms: true
    evidence: >-
      Remote MCP server advertises an OAuth 2.1 authorization server
      (authorization_code + PKCE S256, dynamic client registration) via
      /.well-known/oauth-authorization-server.
  - id: oidc
    conforms: false
    evidence: No /.well-known/openid-configuration document is served.
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use a custom JSON envelope (error, message, details, timestamp,
      requestId), not application/problem+json.
  - id: rest-json
    conforms: true
    evidence: Resource-oriented REST, JSON request/response bodies, standard HTTP verbs and status codes.
  - id: pagination
    conforms: true
    evidence: List endpoints use limit/offset with sort + direction.
  - id: idempotency
    conforms: false
    evidence: No idempotency-key mechanism documented or in the spec.
  - id: rate-limit-headers
    conforms: true
    evidence: X-RateLimit-Limit / Remaining / Reset headers on 429 responses.
  - id: soc2
    conforms: true
    evidence: SOC 2 named on the Brainfish trust center (trust.brainfi.sh).
  - id: iso27001
    conforms: true
    evidence: ISO 27001 named on the Brainfish trust center (trust.brainfi.sh).