generated: '2026-09-19' method: searched source: live probes of Corvera hosts hosts: - host: https://mcp.corvera.ai documents: - path: /.well-known/oauth-authorization-server status: 200 file: corvera-oauth-authorization-server.json - path: /.well-known/openid-configuration status: 404 - path: /.well-known/oauth-protected-resource status: 404 - path: /.well-known/security.txt status: 404 - path: /.well-known/oauth-protected-resource status: 200 file: corvera-mcp-oauth-protected-resource.json bytes: 195 path_echo_control: passed - host: https://docs.corvera.ai documents: - path: /.well-known/mcp.json status: 200 file: corvera-mcp.json - path: /.well-known/security.txt status: 404 - path: /.well-known/oauth-authorization-server status: 404 - host: https://corvera.ai documents: - path: /.well-known/security.txt status: 307 - path: /.well-known/oauth-authorization-server status: 307 notes: The product MCP server publishes RFC 8414 OAuth 2.0 authorization-server metadata (issuer, authorization/token/registration endpoints, PKCE S256, dynamic client registration, scopes openid/email/profile/user:org:read). The docs host publishes an MCP discovery document for its Mintlify-hosted documentation-search server. No security.txt is published on any host. x-mcp-probe: probed: '2026-09-19' issue: roadmap#321, roadmap#337 documents: - host: https://mcp.corvera.ai path: /.well-known/oauth-protected-resource file: corvera-mcp-oauth-protected-resource.json validated_on: resource (RFC 9728) / issuer (RFC 8414, OIDC) negative_control: one per host; a 2xx JSON object at an impossible path discards the host note: 'MCP-host OAuth discovery added 2026-09-19 (roadmap#321/#337): the harvest visits a provider''s primary hosts, and RFC 9728 protected-resource metadata lives on the MCP host, so these documents existed and were invisible to the scorer. Fetched live and validated on `resource`/`issuer`; one negative control per host.'