generated: '2026-08-11'
method: probed
source: live probes of davidprotein.com and account.davidprotein.com
note: >-
  Cross-cutting standards this surface does and does not implement. Every "conforms: true"
  below is backed by a document fetched or a response observed on 2026-08-11. No compliance
  program (SOC 2, ISO 27001, PCI DSS, HIPAA) is published anywhere on the site, so no
  Compliance pointer is emitted.
standards:
- id: ucp-2026-04-08
  name: Universal Commerce Protocol
  conforms: true
  evidence: >-
    /.well-known/ucp returns a merchant profile declaring version 2026-04-08 with the
    shopping service, checkout/cart/order/fulfillment/discount/catalog capabilities and
    three payment handlers.
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence: >-
    Three endpoints answer JSON-RPC 2.0 tools/list; initialize returns protocolVersion
    2024-11-05 and serverInfo universal-commerce 0.1.0.
- id: jsonrpc-2.0
  conforms: true
  evidence: All MCP requests and errors use the JSON-RPC 2.0 envelope.
- id: json-schema-2020-12
  conforms: true
  evidence: >-
    Tool inputSchemas declare $schema https://json-schema.org/draft/2020-12/schema.
- id: oauth2
  name: RFC 6749 / RFC 7636 PKCE
  conforms: true
  evidence: >-
    authorization_code and refresh_token grants with code_challenge_methods_supported
    [S256] in /.well-known/openid-configuration.
- id: oidc-discovery
  name: OpenID Connect Discovery 1.0
  conforms: true
  evidence: /.well-known/openid-configuration returns 200 with issuer, jwks_uri and claims.
- id: rfc8414
  name: OAuth 2.0 Authorization Server Metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200.
- id: rfc9728
  name: OAuth 2.0 Protected Resource Metadata
  conforms: true
  evidence: >-
    /.well-known/oauth-protected-resource returns resource, authorization_servers and
    bearer_methods_supported.
- id: rfc8615
  name: Well-Known URIs
  conforms: true
  evidence: Four .well-known documents served on davidprotein.com.
- id: llmstxt
  conforms: true
  evidence: /llms.txt returns 200 text/markdown, mirroring /agents.md.
- id: agents-md
  conforms: true
  evidence: >-
    /agents.md returns 200 text/markdown and is the canonical agent-facing description of
    the store; it is the sole entry in /sitemap_agentic_discovery.xml.
- id: openapi
  conforms: false
  evidence: >-
    /openapi.json 404 on the store host; no OpenAPI, Swagger or spec link anywhere on the
    site or in agents.md.
- id: a2a
  name: A2A Agent Card
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json both 404 on davidprotein.com
    and account.davidprotein.com.
- id: rfc9457
  name: Problem Details for HTTP APIs
  conforms: false
  evidence: Errors are JSON-RPC error objects returned under HTTP 200.
- id: rfc9116
  name: security.txt
  conforms: false
  evidence: /.well-known/security.txt 404.
- id: rfc8594
  name: Sunset header
  conforms: false
  evidence: No Sunset or Deprecation header observed; no deprecation policy published.
- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface is published to the public.
compliance_program:
  published: false
  note: >-
    No trust centre, no certifications page, no SOC 2 / ISO 27001 / PCI DSS claim. The
    /pages/third-party-testing page is product lab testing of the bars, not information
    security assurance.
x-evidence:
  fetched: '2026-08-11'