generated: '2026-08-30'
method: probed
source: live GET of /.well-known/* on every apis.yml baseURL host, OpenAPI servers[] host,
  and the docs/app hosts
note: >-
  security.txt, openid-configuration, api-catalog and ai-plugin.json are served by NO ClosedLoop AI
  host. What IS served is the MCP OAuth pair (RFC 8414 authorization-server metadata and RFC 9728
  protected-resource metadata) on all four API/MCP hosts, plus an A2A agent card on the docs host.
  app.closedloop.sh answers 200 with the same SPA HTML shell for EVERY /.well-known/* path probed,
  including paths no host should serve -- it is a catch-all, NOT a document, and is recorded here as
  a miss so it is never mistaken for a served surface.
hosts:
- host: api.closedloop.sh
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: closedloop-api-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: closedloop-api-oauth-protected-resource.json
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: eu.api.closedloop.sh
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: closedloop-eu-api-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: closedloop-eu-api-oauth-protected-resource.json
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
- host: mcp.closedloop.sh
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: closedloop-mcp-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: closedloop-mcp-oauth-protected-resource.json
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
- host: eu.mcp.closedloop.sh
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: closedloop-eu-mcp-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: closedloop-eu-mcp-oauth-protected-resource.json
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
- host: docs.closedloop.sh
  documents:
  - path: /.well-known/agent-card.json
    status: 200
    file: ../a2a/closedloop-agent-card.json
    note: A2A Agent Card, JSON object, saved verbatim under a2a/. Also served at
      https://closedloop.sh/docs/.well-known/agent-card.json (200, byte-identical).
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/oauth-protected-resource
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: closedloop.sh
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/oauth-protected-resource
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
  - path: /docs/.well-known/agent-card.json
    status: 200
    file: ../a2a/closedloop-agent-card.json
  - path: /docs/.well-known/agent-skills/closedloopai/skill.md
    status: 200
    file: ../skills/closedloop-closedloopai-published-skill.md
    note: Provider-published Agent Skill, referenced by skills[0].url in the A2A agent card.
- host: app.closedloop.sh
  documents:
  - path: /.well-known/security.txt
    status: 200
    note: NOT A DOCUMENT -- SPA HTML shell. app.closedloop.sh returns the same 200 HTML for every
      /.well-known/* path probed. Recorded as a miss.
  - path: /.well-known/openid-configuration
    status: 200
    note: NOT A DOCUMENT -- same SPA catch-all shell.
  - path: /.well-known/oauth-authorization-server
    status: 200
    note: NOT A DOCUMENT -- same SPA catch-all shell.
  - path: /.well-known/api-catalog
    status: 200
    note: NOT A DOCUMENT -- same SPA catch-all shell.
  - path: /.well-known/ai-plugin.json
    status: 200
    note: NOT A DOCUMENT -- same SPA catch-all shell.
  - path: /.well-known/agent-card.json
    status: 200
    note: NOT A DOCUMENT -- same SPA catch-all shell. The REAL card is on docs.closedloop.sh.