generated: '2026-08-13' method: probed source: >- live probes of https://token.ezoic.com/.well-known/oauth-authorization-server , https://analytics-mcp.ezoic.com/.well-known/oauth-protected-resource , https://setup-agent.ezoic.com/mcp (initialize + tools/list) , https://registry.modelcontextprotocol.io , plus openapi/ and https://docs.ezoic.com/docs/api/ note: >- Round 1 asserted oauth2 and mcp conformance from documentation prose. Round 2 replaces that with measurement: the OAuth discovery documents were fetched and parsed, and the Setup MCP server was initialized and introspected live. The result is a genuinely strong agent-authorization posture (RFC 8414 + RFC 9728 + PKCE + DPoP + dynamic client registration, all published) sitting next to a genuinely weak REST posture (no OpenAPI published by Ezoic, no RFC 9457, no security.txt, no OIDC, query-string API keys). standards: - id: rest conforms: true evidence: JSON-over-HTTPS resource endpoints across three gateway services (/subscriptions/v1, /bdaservices/, /cdnservices/). - id: openapi conforms: false evidence: >- Ezoic publishes no machine-readable API description. Probed /openapi.json, /openapi.yaml, /swagger.json, /api-docs and /docs on api-gateway.ezoic.com (all 503 — gateway rejects unauthenticated), and on docs.ezoic.com and www.ezoic.com (404). The OpenAPI files in this repo are API Evangelist generations from Ezoic's prose docs. - id: mcp conforms: true evidence: >- Two hosted Streamable HTTP MCP servers. setup-agent.ezoic.com/mcp answered initialize with protocolVersion 2025-06-18, serverInfo {"Ezoic Setup", 1.0.0} and capabilities {tools:{listChanged:true}}, then returned a four-tool tools/list with full inputSchemas and annotations. analytics-mcp.ezoic.com/mcp answered 401 with a conformant WWW-Authenticate Bearer resource_metadata challenge. - id: mcp-registry conforms: true evidence: >- Listed in the official MCP Registry as com.ezoic/setup, status active, published 2026-07-07, with a streamable-http remote at https://setup-agent.ezoic.com/mcp. - id: oauth2 conforms: true evidence: >- Authorization server at https://token.ezoic.com with authorization, token, revocation, registration and device-authorization endpoints, response_types [code], and grant types authorization_code, client_credentials, refresh_token, token-exchange and device_code. - id: rfc8414-oauth-authorization-server-metadata conforms: true evidence: 200 at https://token.ezoic.com/.well-known/oauth-authorization-server, valid JSON metadata document. - id: rfc9728-oauth-protected-resource-metadata conforms: true evidence: >- 200 at https://analytics-mcp.ezoic.com/.well-known/oauth-protected-resource — {resource, authorization_servers:[token.ezoic.com], bearer_methods_supported:[header]} — and the same URL is advertised at runtime in the 401 WWW-Authenticate header. - id: rfc7636-pkce conforms: true evidence: code_challenge_methods_supported is [S256] only — no plain fallback. - id: rfc7591-dynamic-client-registration conforms: true evidence: registration_endpoint https://token.ezoic.com/register. - id: rfc7009-token-revocation conforms: true evidence: revocation_endpoint https://token.ezoic.com/token/revoke. - id: rfc8628-device-authorization-grant conforms: true evidence: device_authorization_endpoint published and urn:ietf:params:oauth:grant-type:device_code in grant_types_supported. - id: rfc8693-token-exchange conforms: true evidence: urn:ietf:params:oauth:grant-type:token-exchange in grant_types_supported. - id: rfc9449-dpop conforms: true evidence: dpop_signing_alg_values_supported [ES256]. - id: rfc7517-jwks conforms: true evidence: 200 at https://token.ezoic.com/.well-known/jwks.json. - id: jwt conforms: true evidence: >- Reader identity accepted as an Ezoic Subscriptions session JWT (X-Ezoic-Reader-Token), short-lived and domain-scoped so it cannot be replayed across sites. - id: openid-connect conforms: false evidence: >- No /.well-known/openid-configuration on token.ezoic.com (404) or login.ezoic.com (404), despite id_token_signing_alg_values_supported appearing in the OAuth metadata. Ezoic runs OAuth 2.0, not OIDC. - id: oauth-scopes-published conforms: false evidence: scopes_supported is absent from the authorization-server metadata and no scope reference page is published. Authorization is by Ezoic role permission instead. - id: rfc9457-problem-details conforms: false evidence: >- Subscriptions returns {success, message}; CDN returns {Success, Error}; Big Data Analytics publishes no error contract at all. None is application/problem+json. - id: rfc9116-security-txt conforms: false evidence: >- 404 on /.well-known/security.txt for www.ezoic.com, docs.ezoic.com and analytics-mcp.ezoic.com. Ezoic does run a disclosure program, but publishes it only as prose at https://www.ezoic.com/security (security@ezoic.com). - id: rfc8594-sunset-header conforms: false evidence: No Sunset or Deprecation header policy is published for any Ezoic API. - id: rfc9111-cache-control conforms: true evidence: Subscriptions reads are served with Cache-Control:no-store, and the docs instruct callers not to cache access decisions. - id: llmstxt conforms: true evidence: 200 at https://docs.ezoic.com/llms.txt — a real generated index of the documentation tree, with an llms-full.txt companion. - id: api-versioning conforms: partial evidence: >- Only Subscriptions carries a version segment (/subscriptions/v1). Big Data Analytics and CDN are unversioned, so two of three services have no published mechanism for a breaking change. - id: pagination conforms: partial evidence: >- Big Data Analytics paginates with StartItem/MaxItems but returns no total, no cursor and no page envelope. Subscriptions list endpoints return unbounded full arrays. - id: idempotency conforms: false evidence: No idempotency-key contract on any endpoint, including the mutating createcustomreport and createsegment POSTs. compliance_certifications: published: false note: >- No trust center and no named certification (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP). https://www.ezoic.com/security is a vulnerability-reporting page only, and trust.ezoic.com does not resolve. Ezoic does publish GDPR guidance for publishers at https://docs.ezoic.com/docs/privacy/gdpr/, but that documents the PUBLISHER's obligations, not an Ezoic certification, so no Compliance pointer is wired.