generated: '2026-09-19'
method: probed
source: live probes of /.well-known/* on listingsapi.com, www.listingsapi.com, docs.listingsapi.com (2026-09-03)
hosts:
- host: listingsapi.com
  documents:
  - path: /.well-known/security.txt
    status: 200
    file: listings-api-security.txt
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: listings-api-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: listings-api-oauth-protected-resource.json
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
  - path: /.well-known/agent-skills/index.json
    status: 404
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: listings-api-listingsapi-oauth-protected-resource.json
    bytes: 227
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: listings-api-listingsapi-oauth-authorization-server.json
    bytes: 661
  path_echo_control: passed
- host: www.listingsapi.com
  documents:
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: listings-api-www-oauth-protected-resource.json
  - path: /.well-known/api-catalog
    status: 200
    file: listings-api-api-catalog.json
  - path: /.well-known/agent-skills/index.json
    status: 200
    file: listings-api-agent-skills-index.json
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: docs.listingsapi.com
  documents:
  - path: /.well-known/security.txt
    status: 200
    file: listings-api-security.txt
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: listings-api-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: listings-api-oauth-protected-resource.json
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
notes: Real hits on all three hosts. listingsapi.com serves RFC 9116 security.txt plus RFC 8414 oauth-authorization-server
  and RFC 9728 oauth-protected-resource metadata for the MCP server (resource https://listingsapi.com/mcp,
  scopes read/write, PKCE S256, dynamic client registration). docs.listingsapi.com serves byte-identical
  copies of all three. www.listingsapi.com serves an RFC 9727 api-catalog linkset (anchor https://listingsapi.com/api/v4,
  service-desc https://listingsapi.com/openapi.yaml), a separate oauth-protected-resource doc for the
  REST API (no authorization_servers - API keys only, documented at /auth.md), and an agent-skills discovery
  index at /.well-known/agent-skills/index.json pointing at a provider- published SKILL.md (saved verbatim
  in skills/). No A2A agent card on any host (agent-card.json and agent.json 404 everywhere; the 404 bodies
  are the site's HTML 404 page, not an SPA catch-all 200).
x-mcp-probe:
  probed: '2026-09-19'
  issue: roadmap#321, roadmap#337
  documents:
  - host: https://listingsapi.com
    path: /.well-known/oauth-protected-resource
    file: listings-api-listingsapi-oauth-protected-resource.json
  - host: https://listingsapi.com
    path: /.well-known/oauth-authorization-server
    file: listings-api-listingsapi-oauth-authorization-server.json
  validated_on: resource (RFC 9728) / issuer (RFC 8414, OIDC)
  negative_control: one per host; a 2xx JSON object at an impossible path discards the host
note: 'MCP-host OAuth discovery added 2026-09-19 (roadmap#321/#337): the harvest visits a provider''s
  primary hosts, and RFC 9728 protected-resource metadata lives on the MCP host, so these documents existed
  and were invisible to the scorer. Fetched live and validated on `resource`/`issuer`; one negative control
  per host.'