generated: '2026-07-19'
method: derived
source: >-
  openapi/freight-waves-sonar-openapi.yml ;
  well-known/freight-waves-oauth-authorization-server.json ;
  well-known/freight-waves-oauth-protected-resource.json
standards:
- id: oauth2
  conforms: true
  evidence: MCP server authorization server advertises authorization_code + refresh_token grants (mcp:read scope).
- id: oauth2-pkce
  conforms: true
  evidence: code_challenge_methods_supported includes S256.
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200 with issuer/endpoints.
- id: rfc9728-oauth-protected-resource-metadata
  conforms: true
  evidence: /.well-known/oauth-protected-resource returns 200; MCP 401 challenge references it.
- id: rfc7591-dynamic-client-registration
  conforms: true
  evidence: registration_endpoint present (https://api.freightwaves.com/oauth/register).
- id: mcp
  conforms: true
  evidence: Hosted streamable-http MCP server at api.freightwaves.com/mcp.
- id: http-bearer-auth
  conforms: true
  evidence: SONAR REST API uses Authorization Bearer tokens.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404.
- id: rfc9457-problem-details
  conforms: false
  evidence: No application/problem+json responses documented.
- id: rfc8594-sunset-header
  conforms: false
- id: idempotency
  conforms: false
compliance_program:
  published: false
  note: No public trust center or named certifications (SOC 2 / ISO 27001 / PCI / HIPAA) located; no Compliance pointer emitted.