generated: '2026-08-28' method: probed source: live probes of api.budgetpixel.com, mcp.budgetpixel.com, docs.budgetpixel.com + openapi/budgetpixel-openapi.yaml standards: - id: openapi-3.1 conforms: true evidence: 'openapi/budgetpixel-openapi.yaml declares openapi: 3.1.0, parses clean, 74 operations, 21 component schemas, all operations carry a unique operationId, a summary and a tag.' - id: mcp version: '2025-06-18' conforms: true evidence: 'https://mcp.budgetpixel.com/mcp answered a JSON-RPC initialize with protocolVersion 2025-06-18 and serverInfo {name: budgetpixel, version: 0.1.0}, then returned 12 tools with full inputSchemas via tools/list. Streamable HTTP transport, Mcp-Session-Id header per spec.' - id: oauth2.1 conforms: true evidence: https://mcp.budgetpixel.com/.well-known/oauth-authorization-server (200) declares authorization_code + refresh_token grants, response_types [code], and code_challenge_methods_supported [S256] -- PKCE mandatory, which is the OAuth 2.1 requirement. - id: rfc8414-oauth-as-metadata conforms: true evidence: 200 JSON at /.well-known/oauth-authorization-server on mcp.budgetpixel.com; saved as well-known/budgetpixel-oauth-authorization-server.json - id: rfc9728-protected-resource-metadata conforms: true evidence: 200 JSON at /.well-known/oauth-protected-resource on mcp.budgetpixel.com declaring resource + authorization_servers + bearer_methods_supported [header]. This is what lets an MCP client discover the auth server from a 401 without configuration. - id: rfc7591-dynamic-client-registration conforms: true evidence: registration_endpoint https://mcp.budgetpixel.com/oauth/register declared in the AS metadata; the docs state dynamic client registration so "your agent handles the Google sign-in flow automatically -- no manual token configuration". - id: oidc conforms: false evidence: /.well-known/openid-configuration returns 404 on all four hosts. The AS metadata does advertise the openid and profile scopes, but no OIDC discovery document is served, so this is an OAuth server offering OIDC-named scopes, not a conformant OpenID Provider. - id: a2a version: 1.0.0 conforms: true grade: conformant evidence: https://docs.budgetpixel.com/.well-known/agent-card.json (200) passes all three hard checks -- capabilities is an object, protocolVersion present (0.3), skills is an array. See a2a/budgetpixel-a2a.yml for the deviation list; the card advertises the docs site root as its endpoint, which is not a callable A2A transport. - id: agent-skills conforms: true evidence: https://docs.budgetpixel.com/.well-known/agent-skills/budgetpixel/skill.md (200, 13KB) -- a real provider-published Agent Skill with name/description frontmatter, referenced by skills[0].url in the agent card. - id: llmstxt conforms: true evidence: 'Two live llms.txt documents: https://docs.budgetpixel.com/llms.txt (200, 26KB, the API doc index) and https://budgetpixel.com/llms.txt (200, 1.2KB, a separate index for the free audio library). Both saved to llms/.' - id: openai-plugin-manifest conforms: true partial: true evidence: https://budgetpixel.com/.well-known/ai-plugin.json (200) is a well-formed schema_version v1 manifest, BUT its api.url (https://budgetpixel.com/api/openapi.json) returns 404 -- the manifest points at a spec that is not there. A legacy surface with a dead pointer. - id: rfc9457-problem-details conforms: false evidence: Errors use a nested vendor envelope {"error":{"type","code","message"}} served as application/json. Zero application/problem+json responses in the spec; no type URI, title, detail or instance members. See errors/budgetpixel-problem-types.yml. - id: rfc8594-sunset-header conforms: false evidence: 'No Sunset or Deprecation header documented, no deprecation policy page, and 0 of 74 operations carry deprecated: true.' - id: idempotency-key conforms: false evidence: Zero matches for /idempoten/i in the 292KB OpenAPI and zero matching files across the 84 documentation pages. - id: pagination conforms: false applicable: false evidence: No collection endpoints exist in the REST surface -- 74 create-one/get-one-by-id operations. Not applicable rather than failed. - id: asyncapi conforms: false applicable: false evidence: No event, streaming or webhook surface. The provider states the API is "webhooks-free polling". Not applicable rather than failed. - id: json-schema-2020-12 conforms: true evidence: Implied by OpenAPI 3.1.0, which uses JSON Schema 2020-12 for its schema objects; the 21 component schemas and the 12 MCP tool inputSchemas are all plain JSON Schema. - id: rate-limit-headers conforms: partial evidence: Emits the de-facto X-RateLimit-Limit / -Remaining / -Reset trio plus Retry-After, verified live on a 401 from https://api.budgetpixel.com/v1/models. NOT the IETF draft RateLimit / RateLimit-Policy structured-field form. - id: hsts conforms: partial evidence: docs.budgetpixel.com sets HSTS with max-age 63072000. budgetpixel.com does not, and api.budgetpixel.com returned no HSTS header. See security/budgetpixel-domain-security.yml. - id: dnssec conforms: false evidence: budgetpixel.com is not DNSSEC signed; no CAA records. SPF and DMARC (p=quarantine) are present. domain_standard: market: Generative media / AI model access standard_declared: false note: 'REWARD-ONLY check, recorded as a genuine absence: the generative-media market has no adopted interchange standard for model invocation. There is no SCIM URN, OData $metadata, OpenRTB endpoint, HL7/X12/ISO-20022 message type, LTI/OneRoster shape or OAI-PMH verb to look for in this sector, and none is present. What BudgetPixel does declare instead are the AGENT-side standards -- MCP 2025-06-18, an A2A agent card, an Agent Skill, llms.txt and a legacy ai-plugin manifest -- which is a stronger agent posture than most of its category peers. No standard is invented to fill this slot.' certifications: published: [] trust_center: false note: No SOC 2, ISO 27001, PCI, HIPAA or FedRAMP claim found anywhere on the marketing site, the docs, or a trust subdomain; no trust center and no security.txt. probe-security-programs.py returned vdp=none trust=none. NO Compliance pointer is emitted, because there is nothing published to point at. content_safety: note: 'The one genuinely regulated-adjacent surface here is content safety, and the provider does expose it as API: moderateCSAM and moderateNSFW are first-class operations, and every generation request passes an input moderation gate that returns a stable restriction_reason enum (including input_csam and input_celebrity_likeness). That is a real, machine-readable safety contract, though it is BudgetPixel own scheme rather than conformance to a published standard.'