generated: '2026-09-02' method: probed source: direct HTTPS probes of the named /.well-known/ paths on every EHRbase host note: >- Probed the named path list (never a glob) against all four hosts in the EHRbase surface. Two real documents were returned, both from the WordPress marketing site www.ehrbase.org: an RFC 8414 OAuth authorization-server metadata document and an RFC 9728 OAuth protected-resource metadata document. Both describe a WordPress MCP server mounted at /wp-json/mcp/mcp-oauth-server on the ehrbase.org site itself (scopes_supported = ["mcp"]) - they do NOT describe the EHRbase clinical data repository REST API, which is self-hosted by each deployer and carries no centrally published discovery document. sandkiste.ehrbase.org returned HTTP 200 for EVERY /.well-known/ path with a Vaadin single-page-app HTML shell - a catch-all, not a document - so all of those are recorded as misses. hosts: - host: www.ehrbase.org documents: - path: /.well-known/oauth-authorization-server status: 200 file: ehrbase-oauth-authorization-server.json - path: /.well-known/oauth-protected-resource status: 200 file: ehrbase-oauth-protected-resource.json - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 404 - path: /.well-known/api-catalog status: 404 - path: /.well-known/ai-plugin.json status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/agent.json status: 404 - path: /.well-known/mcp.json status: 404 - host: ehrbase.org documents: - path: /.well-known/oauth-authorization-server status: 200 file: ehrbase-oauth-authorization-server.json note: redirects to www.ehrbase.org; same document - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 404 - path: /.well-known/api-catalog status: 404 - path: /.well-known/ai-plugin.json status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/agent.json status: 404 - host: docs.ehrbase.org documents: - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 404 - path: /.well-known/oauth-authorization-server status: 404 - path: /.well-known/api-catalog status: 404 - path: /.well-known/ai-plugin.json status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/agent.json status: 404 - host: sandkiste.ehrbase.org documents: - path: /.well-known/security.txt status: 200 note: >- NOT a document. Body is the Vaadin SPA HTML shell ("