generated: '2026-08-01'
method: probed
source: >-
  live probes of https://mcp.caisgroup.com/.well-known/* and
  https://login.caisgroup.com/.well-known/*, plus CAIS press releases
description: >-
  Cross-cutting standards conformance for CAIS, asserted only where a live probe or a
  first-party CAIS statement provides evidence. CAIS publishes no OpenAPI, so no
  REST-convention standards (JSON:API, OData, RFC 9457, pagination) can be asserted
  either way — they are recorded as unknown rather than false.
standards:
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence: >-
    Remote MCP server at https://mcp.caisgroup.com/mcp responds to JSON-RPC POSTs with
    an MCP-shaped OAuth challenge; CAIS states in its 2026-05-19 press release "By
    launching as a Model Context Protocol (MCP) server, CAIS enables advisors to query
    fund data, analyze performance, and surface portfolio insights."
- id: oauth2
  name: OAuth 2.0 / 2.1 authorization code
  conforms: true
  evidence: authorization_endpoint + token_endpoint advertised; grant_types_supported [authorization_code, refresh_token]
- id: rfc8414
  name: OAuth 2.0 Authorization Server Metadata
  conforms: true
  evidence: 200 at https://mcp.caisgroup.com/.well-known/oauth-authorization-server
- id: rfc9728
  name: OAuth 2.0 Protected Resource Metadata
  conforms: partial
  evidence: >-
    200 at /.well-known/oauth-protected-resource with resource + authorization_servers
    + scopes_supported + bearer_methods_supported. Partial because the WWW-Authenticate
    challenge advertises resource_metadata at the per-resource path
    /.well-known/oauth-protected-resource/mcp, which returns 404.
- id: rfc7591
  name: OAuth 2.0 Dynamic Client Registration
  conforms: true
  evidence: registration_endpoint https://mcp.caisgroup.com/register advertised; GET returns 405 Method Not Allowed (POST-only)
- id: rfc7009
  name: OAuth 2.0 Token Revocation
  conforms: true
  evidence: revocation_endpoint https://mcp.caisgroup.com/revoke advertised
- id: rfc7636
  name: PKCE
  conforms: true
  evidence: code_challenge_methods_supported [S256]; /authorize rejects a request missing code_challenge
- id: rfc6750
  name: OAuth 2.0 Bearer Token Usage
  conforms: true
  evidence: bearer_methods_supported [header]; 401 responses carry a conformant WWW-Authenticate Bearer challenge with error/error_description
- id: oidc-discovery
  name: OpenID Connect Discovery 1.0
  conforms: true
  scope: members platform only
  evidence: 200 at https://login.caisgroup.com/.well-known/openid-configuration (Auth0 tenant on CAIS custom domain)
- id: rfc7517
  name: JSON Web Key Set
  conforms: true
  scope: members platform only
  evidence: 200 at https://login.caisgroup.com/.well-known/jwks.json
- id: dtcc-aip
  name: DTCC Alternative Investment Products (AIP) reporting protocol
  conforms: true
  evidence: >-
    CAIS press release "CAIS joins DTCC AIP reporting protocol" states CAIS implemented
    the DTCC AIP protocol to standardize reporting and settlement for alternative
    investments across broker/dealers, fund managers, administrators and custodians.
    No technical profile or version is published.
- id: rfc9116
  name: security.txt
  conforms: false
  evidence: 404 on /.well-known/security.txt across www.caisgroup.com, mcp.caisgroup.com and login.caisgroup.com
- id: rfc8615-agent-card
  name: A2A Agent Card at a well-known URI
  conforms: false
  evidence: 404 on /.well-known/agent-card.json and /.well-known/agent.json on every real CAIS host
- id: openapi
  name: OpenAPI
  conforms: false
  evidence: >-
    No OpenAPI/Swagger document found. Probed /openapi.json, /openapi.yaml,
    /swagger.json, /api-docs on www.caisgroup.com and mcp.caisgroup.com (all 404 or
    HTML shell); api./developer./docs./apidocs.caisgroup.com are all NXDOMAIN.
- id: asyncapi
  name: AsyncAPI
  conforms: false
  evidence: no published event, streaming or webhook surface found
- id: rfc9457
  name: Problem Details for HTTP APIs
  conforms: unknown
  evidence: >-
    Only OAuth-style error envelopes ({"error","error_description"}, RFC 6749 §5.2) are
    observable anonymously; the authenticated API surface is not public.
- id: fapi
  name: Financial-grade API (FAPI)
  conforms: false
  evidence: >-
    No FAPI profile advertised. The MCP authorization server supports only
    client_secret_post/client_secret_basic — private_key_jwt and mTLS client
    authentication, which FAPI 1.0 Advanced requires, are not advertised.
compliance_program: none-published
compliance_note: >-
  No trust center, SOC 2 / ISO 27001 / PCI attestation page or public compliance
  program was found on any CAIS host (trust.caisgroup.com and security.caisgroup.com
  are NXDOMAIN). CAIS is a FINRA-member broker-dealer surface (BrokerCheck linked from
  /legal) with an SEC-registered advisory affiliate, CAIS Advisors LLC, but publishes
  no infosec certification claim. No `Compliance` pointer is emitted.