generated: '2026-07-18'
method: searched
source: >-
  https://contra.com/.well-known/* discovery documents, live probes, and
  openapi/contra-openapi-original.json
standards:
- id: oauth2
  conforms: true
  evidence: >-
    OAuth 2.1 authorization server advertised at
    /.well-known/oauth-authorization-server (authorization_code +
    refresh_token grants) for the MCP server.
- id: oidc-discovery
  conforms: true
  evidence: /.well-known/openid-configuration returns a valid OIDC discovery document (200).
- id: rfc8414-oauth-server-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns RFC 8414 metadata (200).
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: >-
    /.well-known/oauth-protected-resource/mcp advertises the protected MCP
    resource; the /mcp 401 challenge references it via resource_metadata.
- id: rfc7591-dynamic-client-registration
  conforms: true
  evidence: POST /api/mcp/oauth/register issues a client_id (Dynamic Client Registration).
- id: pkce
  conforms: true
  evidence: code_challenge_methods_supported = [S256, plain].
- id: mcp
  conforms: true
  evidence: Hosted Model Context Protocol server at https://contra.com/mcp (scope mcp:tools).
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use a custom {code, message} envelope (application/json), not
    application/problem+json.
- id: openapi-3
  conforms: true
  evidence: Public API published as OpenAPI 3.0.3 (contra-open-api.json).