generated: '2026-09-19'
method: searched
notes: 'Round 2 (2026-08-14) found three REAL machine-readable documents the round-1 probe missed, because
  round 1 only probed www/api/documentation and not the MCP or OAuth hosts: (1) https://www.enigma.com/llms.txt
  — 19,025 bytes of text/plain, provider-authored, describing the GraphQL API, the KYB REST API, the MCP
  server and the entity model; (2) https://www.enigma.com/.well-known/mcp/server-card.json — an MCP server
  card against the 2025-10-17 server schema, naming the remote endpoint; (3) https://mcp.enigma.com/.well-known/oauth-authorization-server
  and /.well-known/oauth-protected-resource (RFC 8414 + RFC 9728), plus the same authorization-server
  document served from https://oauth.enigma.com. As in round 1, documentation.enigma.com (Docusaurus)
  and console.enigma.com (SPA) answer 200 with an identical HTML shell for EVERY /.well-known/* path —
  those are soft-404s, not documents, and are recorded as misses. api.enigma.com 302s every /.well-known/*
  request. www.enigma.com/robots.txt additionally carries a Content-Signal declaration (`ai-train=yes,
  search=yes, ai-input=yes`) — a published agent-consent signal, saved verbatim.'
hosts:
- host: https://www.enigma.com
  documents:
  - path: /.well-known/security.txt
    status: 200
    content_type: text/plain
    file: enigma-analytics-security.txt
  - path: /.well-known/mcp/server-card.json
    status: 200
    content_type: application/json
    file: enigma-analytics-mcp-server-card.json
  - path: /llms.txt
    status: 200
    content_type: text/plain
    file: ../llms/enigma-analytics-llms.txt
  - path: /robots.txt
    status: 200
    content_type: text/plain
    file: enigma-analytics-robots.txt
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://mcp.enigma.com
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: enigma-analytics-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
    file: enigma-analytics-oauth-protected-resource.json
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://oauth.enigma.com
  documents:
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    note: byte-identical to the document served from mcp.enigma.com; not saved twice
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: enigma-analytics-oauth-oauth-authorization-server.json
    bytes: 784
  path_echo_control: passed
- host: https://api.enigma.com
  documents:
  - path: /.well-known/openid-configuration
    status: 302
    note: every /.well-known/* path 302s; no document served
  - path: /.well-known/oauth-authorization-server
    status: 302
  - path: /.well-known/api-catalog
    status: 302
  - path: /.well-known/ai-plugin.json
    status: 302
  - path: /.well-known/agent-card.json
    status: 302
  - path: /.well-known/agent.json
    status: 302
- host: https://documentation.enigma.com
  documents:
  - path: /.well-known/openid-configuration
    status: soft-404
  - path: /.well-known/api-catalog
    status: soft-404
  - path: /.well-known/ai-plugin.json
    status: soft-404
  - path: /.well-known/agent-card.json
    status: soft-404
  - path: /.well-known/agent.json
    status: soft-404
  - path: /llms.txt
    status: soft-404
- host: https://console.enigma.com
  documents:
  - path: /.well-known/openid-configuration
    status: soft-404
  - path: /.well-known/agent-card.json
    status: soft-404
  - path: /.well-known/agent.json
    status: soft-404
  - path: /llms.txt
    status: soft-404
x-evidence:
  checked: '2026-08-14'
  real_documents: 6
  soft_404_hosts:
  - documentation.enigma.com
  - console.enigma.com
x-mcp-probe:
  probed: '2026-09-19'
  issue: roadmap#321, roadmap#337
  documents:
  - host: https://oauth.enigma.com
    path: /.well-known/oauth-authorization-server
    file: enigma-analytics-oauth-oauth-authorization-server.json
  validated_on: resource (RFC 9728) / issuer (RFC 8414, OIDC)
  negative_control: one per host; a 2xx JSON object at an impossible path discards the host
note: 'MCP-host OAuth discovery added 2026-09-19 (roadmap#321/#337): the harvest visits a provider''s
  primary hosts, and RFC 9728 protected-resource metadata lives on the MCP host, so these documents existed
  and were invisible to the scorer. Fetched live and validated on `resource`/`issuer`; one negative control
  per host.'