generated: '2026-07-18'
method: searched
source: live probes of ctd.ai and app.ctd.ai .well-known paths
notes: The two 200 responses are the OAuth metadata backing the CTD MCP server (app.ctd.ai/mcp). The bare
  app.ctd.ai/.well-known/oauth-authorization-server path returns the SPA shell (HTML), not JSON; the real
  RFC 8414 document is served under the users-api issuer path recorded above.
hosts:
- host: app.ctd.ai
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: ctd-oauth-authorization-server.json
    type: oauth-authorization-server
    standard: RFC 8414
    url: https://app.ctd.ai/users-api/.well-known/oauth-authorization-server
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: ctd-oauth-protected-resource.json
    type: oauth-protected-resource
    standard: RFC 9728
    url: https://app.ctd.ai/.well-known/oauth-protected-resource
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
x-shape-fix:
  converted: '2026-08-20'
  from: entries
  note: Rewritten into hosts[] -> documents[], the only shape well_known_docs() in score.rb reads. A served
    .well-known surface recorded in any other shape scores as absent.