generated: '2026-08-21'
method: probed
source: https://gigaio.com/.well-known/oauth-authorization-server
description: >-
  Cross-cutting and domain-standard conformance for GigaIO. The only contract GigaIO
  serves publicly is the OAuth/MCP discovery pair on gigaio.com, so every `conforms:
  true` below is evidenced from a document that was actually fetched. GigaIO's product
  API standard — DMTF Redfish for FabreX fabric management — is claimed repeatedly in
  marketing copy but no Redfish service root, schema bundle or reference is published
  at any public URL, so it is recorded as claimed-but-unverifiable rather than
  conformant. Nothing here is inferred from prose alone.
standards:
  - id: oauth2
    name: OAuth 2.0 (RFC 6749)
    conforms: true
    evidence:
      url: https://gigaio.com/.well-known/oauth-authorization-server
      http_status: 200
      detail: >-
        authorization_endpoint, token_endpoint and revocation_endpoint published;
        grant_types_supported [authorization_code, refresh_token];
        response_types_supported [code].
  - id: rfc8414
    name: OAuth 2.0 Authorization Server Metadata (RFC 8414)
    conforms: true
    evidence:
      url: https://gigaio.com/.well-known/oauth-authorization-server
      http_status: 200
      detail: Served at the registered well-known path with a valid JSON metadata object.
  - id: rfc9728
    name: OAuth 2.0 Protected Resource Metadata (RFC 9728)
    conforms: true
    evidence:
      url: https://gigaio.com/.well-known/oauth-protected-resource
      http_status: 200
      detail: >-
        resource https://gigaio.com/wp-json/mcp/mcp-oauth-server, authorization_servers
        [https://gigaio.com], bearer_methods_supported [header], scopes_supported [mcp].
  - id: rfc7636
    name: PKCE (RFC 7636)
    conforms: true
    evidence:
      url: https://gigaio.com/.well-known/oauth-authorization-server
      http_status: 200
      detail: code_challenge_methods_supported ["S256"] — plain is not offered.
  - id: rfc7009
    name: OAuth 2.0 Token Revocation (RFC 7009)
    conforms: true
    evidence:
      url: https://gigaio.com/.well-known/oauth-authorization-server
      http_status: 200
      detail: revocation_endpoint https://gigaio.com/oauth/revoke published.
  - id: mcp
    name: Model Context Protocol
    conforms: true
    evidence:
      url: https://gigaio.com/wp-json/mcp/mcp-oauth-server
      http_status: 401
      detail: >-
        JSON-RPC endpoint registered under the `mcp` REST namespace; an anonymous
        tools/list returns the MCP-shaped error {"code":"mcp_unauthorized"}, and the
        resource is described by an RFC 9728 document. The tool set itself is
        auth-gated and was not introspected.
  - id: oidc
    name: OpenID Connect Discovery
    conforms: false
    evidence:
      url: https://gigaio.com/.well-known/openid-configuration
      http_status: 404
  - id: rfc9457
    name: Problem Details for HTTP APIs (RFC 9457)
    conforms: false
    evidence:
      url: https://gigaio.com/wp-json/mcp/mcp-oauth-server
      http_status: 401
      detail: >-
        Errors use the WordPress REST envelope {code, message, data.status}, not
        application/problem+json.
  - id: rfc9116
    name: security.txt (RFC 9116)
    conforms: false
    evidence:
      url: https://gigaio.com/.well-known/security.txt
      http_status: 404
domain_standards:
  - id: dmtf-redfish
    name: DMTF Redfish
    market: composable / disaggregated datacenter infrastructure management
    conforms: false
    status: claimed-unverifiable
    evidence:
      url: https://gigaio.com/products/fabrex-software/
      http_status: 200
      detail: >-
        GigaIO states "DMTF open-source Redfish APIs provide unprecedented integration
        with a range of third-party applications for fabric automation and
        orchestration" and that fabric management is administered with Redfish RESTful
        APIs. This is a marketing claim on a product page, not a contract. No Redfish
        service root (/redfish/v1), schema bundle, OpenAPI or reference is published at
        any public GigaIO URL, and the CLI page tells readers to "CONTACT US for details
        on APIs". Per the 0.12.0 rule that domain-standard conformance is read from the
        CONTRACT and not from prose, this is not scored as conformance. It is recorded
        because the claim is specific, repeated across GigaIO's own datasheets, and
        would be trivially verifiable if GigaIO published a Redfish service document.
      note: >-
        FabreX became a d-Matrix trademark following the April 2026 sale of GigaIO's
        datacenter technology and assets, so any future public Redfish contract for
        FabreX may be published by d-Matrix rather than by GigaIO.
certifications: []
certifications_note: >-
  No trust center, compliance page or named certification (SOC 2, ISO 27001, FedRAMP)
  is published on gigaio.com; probe-security-programs.py returned vdp=none trust=none.
  No `Compliance` or `TrustCenter` pointer is emitted.