generated: '2026-08-04'
method: probed
source: live probes of shop.katefarms.com + graphql/kate-farms-storefront.graphql
standards:
- id: graphql
  conforms: true
  evidence: Anonymous introspection at https://shop.katefarms.com/api/2026-01/graphql.json
    returned a valid __schema with 424 types, 35 query fields and 41 mutations on 2026-08-04.
- id: graphql-cursor-connections
  conforms: true
  evidence: 29 Relay Connection types with edges/node/cursor/pageInfo across the schema;
    first/last/after/before arguments on every list field.
- id: oidc-discovery
  conforms: true
  evidence: 'https://shop.katefarms.com/.well-known/openid-configuration returns 200
    with issuer, authorization_endpoint, token_endpoint, jwks_uri, RS256 id_token signing.'
- id: oauth2
  conforms: true
  evidence: authorization_code + refresh_token + jwt-bearer grant types advertised;
    client_secret_basic token endpoint auth.
- id: rfc8414-authorization-server-metadata
  conforms: true
  evidence: https://shop.katefarms.com/.well-known/oauth-authorization-server returns
    200 with authorization server metadata.
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: https://shop.katefarms.com/.well-known/oauth-protected-resource returns
    200 declaring resource https://shop.katefarms.com and bearer_methods_supported
    [header].
- id: rfc7636-pkce
  conforms: true
  evidence: code_challenge_methods_supported includes S256.
- id: rfc8615-well-known-uris
  conforms: true
  evidence: Five /.well-known/ documents served with 200 on the storefront host.
- id: mcp
  conforms: partial
  evidence: A JSON-RPC 2.0 MCP endpoint is advertised at https://shop.katefarms.com/api/ucp/mcp
    and answers with well-formed JSON-RPC error objects, but tools/list is gated on
    a UCP agent profile, so MCP capability negotiation could not be completed anonymously.
- id: ucp
  conforms: true
  version: '2026-04-08'
  evidence: https://shop.katefarms.com/.well-known/ucp returns a complete Universal
    Commerce Protocol merchant profile with services, capabilities and payment handlers.
- id: llmstxt
  conforms: true
  evidence: https://shop.katefarms.com/llms.txt returns 200 with a real agent-instruction
    document, mirrored at /agents.md.
- id: a2a
  conforms: false
  evidence: No agent card at /.well-known/agent-card.json or /.well-known/agent.json
    on any Kate Farms host (all 404).
- id: openapi
  conforms: false
  evidence: No OpenAPI/Swagger document found at any probed path on katefarms.com,
    shop.katefarms.com or katefarmsmedical.com; api.katefarms.com and developer.katefarms.com
    do not resolve.
- id: asyncapi
  conforms: false
  evidence: No AsyncAPI document and no publicly documented webhook surface. Shopify
    webhooks are an Admin API facility, not something Kate Farms publishes to third
    parties.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are GraphQL typed userErrors[] with enum codes, not application/problem+json.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every host.
- id: rfc8594-sunset-header
  conforms: false
  evidence: Deprecation is signalled by the in-schema @deprecated directive and quarterly
    version retirement, not by Sunset/Deprecation HTTP headers.
- id: hsts
  conforms: true
  evidence: 'HSTS present on both katefarms.com (max-age 31536000) and shop.katefarms.com
    (max-age 7889238) — see security/kate-farms-domain-security.yml.'
- id: dnssec
  conforms: true
  evidence: DNSSEC enabled on katefarms.com.
- id: caa
  conforms: false
  evidence: No CAA records published for katefarms.com.
- id: dmarc
  conforms: partial
  evidence: DMARC record present but policy is p=none (monitor only).
compliance_program:
  published: false
  note: No trust center, no named certifications (SOC 2 / ISO 27001 / HIPAA / PCI)
    and no compliance page were found on any Kate Farms host. As a medical-nutrition
    company selling into hospitals, Kate Farms is very likely subject to FDA medical-food
    labelling requirements and to HIPAA when handling patient data through its reimbursement
    channels, but it publishes nothing machine- or human-readable to that effect on
    its public surface, so no Compliance pointer is asserted here.
x-evidence:
  fetched: '2026-08-04'