generated: '2026-08-12'
method: derived
source: >-
  openapi/, well-known/, conventions/ and live observation of www.fabric8labs.com. No compliance or
  certification claim of any kind was found on the company's site, so nothing here is a provider
  assertion — each entry is a measurement against the standard's own requirements.
note: >-
  No Compliance pointer is emitted in apis.yml. Fabric8Labs publishes no SOC 2, ISO 27001, ITAR,
  AS9100, PCI, HIPAA or FedRAMP claim, no trust center and no certifications page, which is notable
  for a company manufacturing aerospace and defence-adjacent components but is nonetheless the
  measurement. This file asserts conformance to cross-cutting web/API standards only.
standards:
- id: openapi-3.1
  conforms: true
  evidence: Seven OpenAPI 3.1.0 documents in openapi/, derived from the site's own route index and
    OPTIONS schemas. Note these are API Evangelist artifacts; Fabric8Labs publishes no OpenAPI.
  published_by_provider: false
- id: json-schema-2020-12
  conforms: true
  evidence: The per-route OPTIONS documents the site serves carry JSON Schema draft-04-flavoured
    resource schemas that were normalised into the components.schemas blocks in openapi/.
  published_by_provider: true
- id: oauth2
  conforms: true
  evidence: RFC 6749/OAuth 2.1 authorization-code flow declared in
    well-known/fabric8labs-oauth-authorization-server.json and enforced with a 401 challenge on the
    MCP endpoint.
  published_by_provider: true
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200 with a valid metadata document.
  published_by_provider: true
- id: rfc9728-oauth-protected-resource-metadata
  conforms: true
  evidence: /.well-known/oauth-protected-resource returns 200 and correctly binds the MCP resource
    to the site's authorization server.
  published_by_provider: true
- id: rfc7636-pkce
  conforms: true
  evidence: code_challenge_methods_supported is ["S256"].
  published_by_provider: true
- id: rfc6750-bearer-token
  conforms: true
  evidence: 'bearer_methods_supported is ["header"], and the 401 carries a well-formed
    WWW-Authenticate: Bearer challenge including resource_metadata.'
  published_by_provider: true
- id: mcp
  conforms: partial
  evidence: A live JSON-RPC 2.0 MCP endpoint is registered and correctly advertised, but the
    protocol version and tool set could not be verified because tools/list is auth-gated.
  published_by_provider: true
- id: rfc5988-web-linking
  conforms: true
  evidence: 'Collection responses emit Link: <...>; rel="next" / rel="prev".'
  published_by_provider: true
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use the WordPress envelope {code,message,data.status} with content-type
    application/json. No application/problem+json and no type URI.
  published_by_provider: false
- id: openid-connect
  conforms: false
  evidence: /.well-known/openid-configuration returns 404. The authorization server is OAuth-only,
    with no id_token or userinfo surface.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404.
- id: rfc9727-api-catalog
  conforms: false
  evidence: /.well-known/api-catalog returns 404.
- id: a2a
  conforms: false
  evidence: Both /.well-known/agent-card.json and /.well-known/agent.json return 404.
- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface exists on this host. Not applicable rather than
    deficient.
- id: hsts
  conforms: true
  evidence: Strict-Transport-Security max-age=63072000; includeSubDomains; preload.
- id: dnssec
  conforms: false
  evidence: No DNSSEC on fabric8labs.com. See security/fabric8labs-domain-security.yml.
- id: caa
  conforms: false
  evidence: No CAA records published for fabric8labs.com.
- id: dmarc
  conforms: partial
  evidence: DMARC record present but policy is p=none, which monitors without enforcing.
- id: idempotency
  conforms: false
  evidence: No idempotency key mechanism. The public surface is read-only.
summary:
  standards_evaluated: 20
  conforms: 10
  partial: 2
  does_not_conform: 8
  provider_published_compliance_program: false
x-evidence:
  fetched: '2026-08-12'
  host: www.fabric8labs.com