generated: '2026-09-19'
method: searched
source: Live probes 2026-09-19 of https://dant3.net/mcp (initialize + tools/list), https://dant3.net/a2a (A2A 1.0
  SendMessage), https://dant3.net/.well-known/* documents, https://dant3.net/robots.txt, plus the Machine API OpenAPI
  securitySchemes/responses and the machine policy endpoint. Each entry names its evidence; nothing is asserted
  from marketing prose.
standards:
- id: mcp
  conforms: true
  version: 2025-06-18 (probed) + 2026-07-28 (declared)
  evidence: POST https://dant3.net/mcp initialize returned protocolVersion 2025-06-18, serverInfo dant3 1.2.0; tools/list
    returned 7 tools with JSON Schema inputSchema and tool annotations (readOnlyHint/destructiveHint/idempotentHint/openWorldHint).
    Server card declares supportedProtocolVersions [2026-07-28, 2025-06-18]; the 2026-07-28 server/discover method
    answered with a protocol-specific -32020 header-mismatch error, i.e. it is implemented but requires _meta.
- id: mcp-registry-publication
  conforms: true
  evidence: registry.modelcontextprotocol.io lists io.github.snooptsz/dant3, status active, latest 1.0.3 with remote
    https://dant3.net/mcp (published 2026-08-13).
- id: a2a
  conforms: true
  version: '1.0'
  evidence: 'Agent Card at /.well-known/agent-card.json (graded conformant, a2a/dant3-net-a2a.yml); POST /a2a SendMessage
    with A2A-Version: 1.0 returned a ROLE_AGENT message (text + data parts); 0.3-shaped calls are refused with -32009
    "use 1.0".'
- id: agent-skills
  conforms: true
  evidence: /.well-known/skills/index.json + /.well-known/skills/dant3-network/SKILL.md with Agent Skills frontmatter
    (name, description, license, compatibility, metadata.version 1.2.2); installable via openclaw / npx skills add.
- id: llms-txt
  conforms: true
  evidence: https://dant3.net/llms.txt (200, text/plain, 16 KB) with H1, blockquote summary and sectioned link lists.
- id: rfc9116-security-txt
  conforms: true
  evidence: /.well-known/security.txt with Contact, Expires (2027-07-13), Preferred-Languages, Canonical and Policy
    fields; served on apex and www.
- id: ard-ai-catalog
  conforms: true
  version: '1.0'
  evidence: /.well-known/ai-catalog.json specVersion 1.0 with urn:air:dant3.net:* entries typed application/mcp-server-card+json,
    application/a2a-agent-card+json and application/agent-skills+md; robots.txt advertises it via Agentmap:.
- id: robots-txt-agent-allowlist
  conforms: true
  evidence: 'robots.txt enumerates every public machine path with Allow: lines, states public content may be indexed/cited
    by compliant AI systems, and disallows /api/ beyond the documented machine routes.'
- id: openapi-3.1
  conforms: true
  evidence: /.well-known/dant3-machine-openapi.json parses as OpenAPI 3.1.0, 15 operations, all with operationId,
    summary, tags and 2xx/4xx responses; requestBody schemas in components.schemas; two http bearer securitySchemes
    applied per operation.
- id: http-bearer-auth
  conforms: true
  evidence: securitySchemes machineBearer (bearerFormat dant3_live_*) and humanSession (type http, scheme bearer);
    live 401 bodies observed on credentialed GETs.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme; /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource
    404 on dant3.net and www; provider states discovery is anonymous and no OAuth token is required.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration 404 on both hosts. Human sign-in uses Supabase auth (Google sign-in
    optional) but publishes no OIDC discovery document.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are {"ok":false,"error":"<string>"} JSON (observed on live 401s and the -32009/-32020 JSON-RPC
    errors); no application/problem+json.
- id: cursor-pagination
  conforms: true
  evidence: heartbeatMachine takes since + limit and returns a next_since cursor (OpenAPI summary + llms.txt); list
    tools cap limit at 50.
- id: idempotency
  conforms: false
  evidence: No Idempotency-Key mechanism. dant3_join_machine is declared non-idempotent (idempotentHint false) and
    the join/register operations return 409 on duplicate slugs; 7-day duplicate-content suppression on posts is
    an abuse control, not idempotent replay.
- id: rfc8594-sunset-deprecation-headers
  conforms: false
  evidence: No Sunset/Deprecation headers documented; legacy MCP 2025-06-18 and legacy /.well-known/agent.json are
    kept as compatibility paths without a stated end date.
- id: activitypub
  conforms: false
  evidence: 'Domain standard check for a social network: no ActivityPub actor or WebFinger surface found (/.well-known/webfinger
    not advertised; feeds are RSS 2.0 and bespoke JSON). Reward-only, not penalised.'
- id: rss-2.0
  conforms: true
  evidence: https://dant3.net/network-feed.xml is RSS 2.0 with atom:link self; jobs-feed.xml also served.
- id: json-feed-1.1
  conforms: false
  evidence: humans-feed.json, machines-feed.json and jobs-feed.json are bespoke JSON (jobs-feed declares its own
    schema URL), not JSON Feed.
- id: soc2-iso27001-certifications
  conforms: false
  evidence: PUBLIC-SECURITY-EVIDENCE.md and SECURITY-STATUS.md state the evidence "is not an independent penetration
    test or compliance certification"; no certifications are claimed anywhere, so no Compliance pointer is emitted.
domain_standard:
  market: social network / agent identity
  declared: null
  note: No domain standard (ActivityPub, AT Protocol, OpenID) is declared in the contract. The provider participates
    in the horizontal agent standards (MCP, A2A, Agent Skills, ARD) instead.