generated: '2026-07-19'
method: searched
source: live probes of the /.well-known/ surface on each Linktree host
note: >-
  Linktree publishes an RFC 9727 api-catalog linkset whose single anchor is the MCP endpoint —
  the api-catalog is how the MCP server is discoverable from the apex domain. There is no
  security.txt on any host.
hosts:
- host: https://linktr.ee
  documents:
  - path: /.well-known/api-catalog
    status: 200
    content_type: application/linkset+json
    rfc: RFC 9727
    file: linktree-api-catalog.json
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    rfc: RFC 8414
    file: linktree-oauth-authorization-server.json
  - path: /.well-known/mcp/server-card.json
    status: 200
    content_type: application/json
    file: linktree-mcp-server-card.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    rfc: RFC 9728
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/mcp/tools.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
    checked: '2026-08-13'
  - path: /.well-known/agent.json
    status: 404
    checked: '2026-08-13'
- host: https://mcp.linktr.ee
  documents:
  - path: /.well-known/oauth-protected-resource
    status: 200
    rfc: RFC 9728
  - path: /.well-known/oauth-authorization-server
    status: 200
    rfc: RFC 8414
  - path: /.well-known/mcp/server-card.json
    status: 200
  - path: /.well-known/mcp/tools.json
    status: 200
    file: ../mcp/linktree-mcp-tools.json
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
    checked: '2026-08-13'
  - path: /.well-known/agent.json
    status: 404
    checked: '2026-08-13'
- host: https://arbor.linktr.ee
  added: '2026-08-13'
  note: >-
    The public Arbor component registry. Serves a real machine-readable API surface
    (/manifest.json, /r/{name}.json, /health, /llms.txt) but nothing under /.well-known/ —
    every path below returns the registry's own styled 404 HTML page, not an SPA soft-200.
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
  non_well_known_discovery:
  - path: /llms.txt
    status: 200
    content_type: text/plain
    file: ../llms/linktree-arbor-llms.txt
  - path: /manifest.json
    status: 200
    content_type: application/json
    file: ../components/linktree-arbor-registry-manifest.json
  - path: /health
    status: 200
- host: https://api.linktr.ee
  reachable: false
  note: host resolves but every path returns 503; it is not a public API surface.
  documents:
  - path: /.well-known/security.txt
    status: 503
  - path: /.well-known/openid-configuration
    status: 503
  - path: /.well-known/oauth-authorization-server
    status: 503
  - path: /.well-known/api-catalog
    status: 503
  - path: /.well-known/ai-plugin.json
    status: 503
agent_card:
  present: false
  checked: '2026-08-13'
  paths: [/.well-known/agent-card.json, /.well-known/agent.json]
  hosts: [linktr.ee, mcp.linktr.ee, arbor.linktr.ee, api.linktr.ee]
  results: 404 on linktr.ee, mcp.linktr.ee and arbor.linktr.ee; 503 on api.linktr.ee
  note: >-
    No A2A agent card is served on any Linktree host. Per pipeline rule this artifact is never
    generated or derived, so no a2a/ directory exists and no AgentCard pointer is claimed. The
    negative probe is recorded here as data. Note that linktr.ee returns its branded HTML 404
    page (a real 404, not an SPA soft-200), so this is a genuine absence rather than an
    undetectable catch-all.
security_txt:
  present: false
  checked: [https://linktr.ee/.well-known/security.txt, https://mcp.linktr.ee/.well-known/security.txt]
  note: >-
    Linktree runs a public bug bounty on Bugcrowd but does not publish an RFC 9116 security.txt.
    See security/linktree-vulnerability-disclosure.yml.