generated: '2026-08-08'
method: probed
source: live GET of /.well-known/* on every Bulletproof host
note: >-
  Probed on 2026-08-08. Every 200 below was verified to parse as JSON before being
  saved; every 404 was an observed status, not an assumption. Bulletproof publishes
  no security.txt and no agent card on any host.
hosts:
- host: https://shop.bulletproof.com
  documents:
  - path: /.well-known/ucp
    description: Universal Commerce Protocol merchant profile (services, capabilities, payment handlers)
    status: 200
    content_type: application/json
    file: bulletproof-ucp.json
  - path: /.well-known/openid-configuration
    description: OpenID Connect discovery for Shopify customer accounts
    status: 200
    content_type: application/json
    file: bulletproof-openid-configuration.json
  - path: /.well-known/oauth-authorization-server
    description: RFC 8414 OAuth 2.0 authorization server metadata
    status: 200
    content_type: application/json
    file: bulletproof-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    description: RFC 9728 OAuth 2.0 protected resource metadata
    status: 200
    content_type: application/json
    file: bulletproof-oauth-protected-resource.json
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
  - path: /.well-known/api-catalog
    status: 404
- host: https://account.bulletproof.com
  documents:
  - path: /.well-known/openid-configuration
    status: 200
    content_type: application/json
    note: identical issuer to the shop host (shopify.com/authentication/434700319)
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://bulletproof-coffee.myshopify.com
  documents:
  - path: /.well-known/ucp
    status: 200
    content_type: application/json
    note: canonical myshopify origin the shop host's UCP profile points back at
  - path: /.well-known/openid-configuration
    status: 200
  - path: /.well-known/oauth-protected-resource
    status: 200
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://www.bulletproof.com
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
  - path: /.well-known/ucp
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
non_well_known_discovery:
- url: https://shop.bulletproof.com/llms.txt
  status: 200
  content_type: text/markdown
  file: ../llms/bulletproof-llms.txt
- url: https://shop.bulletproof.com/agents.md
  status: 200
  content_type: text/markdown
  file: ../skills/bulletproof-agents.md
- url: https://www.bulletproof.com/llms.txt
  status: 200
  content_type: text/plain
  file: ../llms/bulletproof-www-llms.txt
  note: generated by the Yoast SEO WordPress plugin; editorial content index, not an API surface