generated: '2026-08-14' method: searched source: - openapi/_original/explorium-agentsource-openapi.json - https://www.explorium.ai/.well-known/api-catalog - https://www.explorium.ai/.well-known/agent-card.json - https://www.explorium.ai/.well-known/mcp/server-card.json - https://www.explorium.ai/.well-known/ai-catalog.json - https://mcp.explorium.ai/.well-known/oauth-authorization-server - https://www.explorium.ai/data-security/ description: >- Explorium conforms to an unusually deep stack of AGENT-ERA discovery standards - RFC 9727 api-catalog, A2A 1.0.0, MCP with RFC 8414 OAuth metadata and RFC 7591 dynamic client registration, llms.txt, an ARD/AIR capability catalog and an agent-skills index - while skipping most of the classic HTTP-API hygiene standards: no RFC 9457 problem details, no RFC 9116 security.txt, no RFC 8594 sunset headers, no OpenID Connect, no idempotency. That inversion is the finding. standards: - id: openapi-3.1 conforms: true evidence: >- OpenAPI 3.1.0 served anonymously at https://api.explorium.ai/openapi.json, 120 paths, 127 operations, 316 component schemas, securitySchemes defined and applied to 125 operations. - id: rfc9727-api-catalog conforms: true evidence: >- https://www.explorium.ai/.well-known/api-catalog returns a valid linkset with anchor, service-desc (application/vnd.oai.openapi+json), service-doc and service-meta relations. - id: a2a-1.0.0 conforms: true evidence: >- Agent card at the canonical /.well-known/agent-card.json, protocolVersion 0.3.0, capabilities as an object, skills as an array, preferredTransport and default I/O modes present. Graded conformant in a2a/explorium-a2a.yml. - id: mcp conforms: true evidence: >- Hosted Streamable HTTP server at https://mcp.explorium.ai/mcp, with an anonymous pre-connection server card at /.well-known/mcp/server-card.json and a self-hostable MIT-licensed stdio build. - id: oauth2 conforms: true evidence: >- The MCP surface runs OAuth 2.0 authorization_code + refresh_token; an unauthenticated initialize returns WWW-Authenticate: Bearer realm="OAuth". - id: rfc8414-oauth-authorization-server-metadata conforms: true evidence: >- https://mcp.explorium.ai/.well-known/oauth-authorization-server returns issuer, authorization_endpoint, token_endpoint, registration_endpoint, revocation_endpoint, grant_types_supported and code_challenge_methods_supported. - id: rfc7636-pkce conforms: true evidence: code_challenge_methods_supported includes S256 (and plain). - id: rfc7591-dynamic-client-registration conforms: true evidence: registration_endpoint https://mcp.explorium.ai/register is advertised. - id: rfc9728-oauth-protected-resource-metadata conforms: false evidence: >- /.well-known/oauth-protected-resource returns 404 on mcp.explorium.ai, so an MCP client cannot discover the authorization server from the resource; it must rely on the WWW-Authenticate challenge. - id: llmstxt conforms: true evidence: >- /llms.txt served on both www.explorium.ai and developers.explorium.ai, with scoped indexes for the blog, resource center, use cases and integrations. - id: agent-skills conforms: true evidence: >- A skills index at /.well-known/agent-skills/index.json (7 capabilities) and a published skill document at developers.explorium.ai/.well-known/agent-skills/explorium/skill.md. - id: ard-ai-catalog conforms: true evidence: >- /.well-known/ai-catalog.json, specVersion 1.0, four entries with urn:air: identifiers, per-entry trustManifest and representativeQueries. - id: apikey-auth conforms: true evidence: OpenAPI securityScheme APIKeyHeader, apiKey in header named api_key. - id: openidconnect conforms: false evidence: No /.well-known/openid-configuration on any host; no openIdConnect scheme in the spec. - id: oauth-scopes conforms: false evidence: >- The authorization-server metadata advertises no scopes_supported, and no scope reference is published. Access is account-scoped, all-or-nothing. - id: rfc9457-problem-details conforms: false evidence: >- No application/problem+json anywhere. Errors use three different bespoke envelopes (details/correlation_id, FastAPI detail[], and a 429 shape that itself has two documented variants). See errors/. - id: rfc9116-security-txt conforms: false evidence: /.well-known/security.txt returns 404 on every Explorium host. - id: rfc8594-sunset-header conforms: false evidence: No Sunset or Deprecation header documented or declared; no deprecation policy published. - id: idempotency conforms: false evidence: >- No Idempotency-Key parameter in 127 operations and no idempotency guidance in the docs, on an API where every read is a credit-spending POST. - id: rfc6585-429 conforms: true evidence: >- 429 on exhaustion with Retry-After, plus X-RateLimit-Limit / -Remaining / -Reset on every response. - id: ietf-ratelimit-headers conforms: false evidence: >- Uses the de-facto X-RateLimit-* family, not the standards-track RateLimit/RateLimit-Policy fields. - id: webhook-hmac-signing conforms: true evidence: >- HMAC-SHA256 over "{timestamp}.{body}" in X-Signature with X-Timestamp and a 300-second replay window, verified with constant-time comparison in the published example. - id: gdpr conforms: true evidence: >- Claimed on https://www.explorium.ai/data-security/ and detailed in the privacy policy, with a named EU representative (explorium.eu@privacyminders.com). - id: ccpa conforms: true evidence: >- Claimed on the data-security page; a "Do Not Sell My Personal Info" page is published at https://explorium.ai/do-not-sell-my-personal-info/. - id: soc2 conforms: true evidence: >- SOC 2 badge published on https://www.explorium.ai/data-security/. No report, type, scope or audit date is disclosed publicly; detail is behind a Security & Privacy FAQ PDF. - id: iso-27001 conforms: true evidence: >- ISO 27001 badge published on https://www.explorium.ai/data-security/. No certificate number or certifying body is disclosed publicly. - id: fhir-r4 conforms: false - id: scim conforms: false - id: odata conforms: false - id: jsonapi conforms: false - id: fapi conforms: false - id: psd2 conforms: false summary: agent_era_standards_met: 9 classic_http_hygiene_standards_missed: 6 note: >- Explorium is one of the most discovery-conformant providers in the catalog at the agent layer and one of the least conformant at the runtime-semantics layer. An agent can find this API without being told it exists, and then has no problem+json, no scopes, no idempotency and no sunset contract once it starts calling. maintainers: - FN: Kin Lane email: kin@apievangelist.com