generated: '2026-08-09'
method: searched
source: probed /.well-known/* on every Cloud9 host in apis.yml
description: >-
  Well-known discovery surface probed across the Cloud9 hosts. The notable find is on cloud9.gg,
  which publishes BOTH RFC 8414 OAuth authorization-server metadata and RFC 9728 OAuth
  protected-resource metadata pointing at a remote MCP server at
  https://cloud9.gg/wp-json/mcp/mcp-oauth-server. Both documents are served from the WordPress
  MCP adapter on the site, not from a bespoke Cloud9 identity provider. No security.txt (RFC
  9116), no api-catalog (RFC 9727), no OpenID Connect discovery document, no ai-plugin.json and
  no A2A agent card were found on any Cloud9 host. Note that cloud9.gg answers every unmatched
  /.well-known/* path with an HTTP 404 carrying the site's HTML 404 page, so the two 200s below
  are genuine JSON hits and not a single-page-app catch-all.
hosts:
- host: https://cloud9.gg
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: cloud9-oauth-authorization-server.json
    spec: RFC 8414
    note: >-
      Served after a 301 to the trailing-slash form
      https://cloud9.gg/.well-known/oauth-authorization-server/
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
    file: cloud9-oauth-protected-resource.json
    spec: RFC 9728
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://store.cloud9.gg
  documents:
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://club9.cloud9.gg
  documents:
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
other_discovery:
  robots_txt:
    url: https://cloud9.gg/robots.txt
    status: 200
    sitemap: https://cloud9.gg/wp-sitemap.xml
  llms_txt:
    url: https://cloud9.gg/llms.txt
    status: 404
  wordpress_rest_index:
    url: https://cloud9.gg/wp-json/
    status: 200
    note: >-
      Not a /.well-known/ document, but the site's actual machine-readable API discovery
      surface. Recorded in json-schema/cloud9-wp-rest-index.json.
x-evidence:
  fetched: '2026-08-09'
  probes:
  - url: https://cloud9.gg/.well-known/oauth-authorization-server
    status: 200
  - url: https://cloud9.gg/.well-known/oauth-protected-resource
    status: 200
  - url: https://cloud9.gg/.well-known/security.txt
    status: 404
  - url: https://cloud9.gg/.well-known/agent-card.json
    status: 404
  - url: https://cloud9.gg/.well-known/agent.json
    status: 404