generated: '2026-09-19' method: searched source: live /.well-known probes across every Lukka host summary: documents_found: 13 hosts_with_documents: 9 security_txt: false api_catalog: false agent_card: false ai_plugin: false note: 'Lukka publishes a complete OAuth/OIDC discovery surface across two identity planes (Okta for the data APIs, Auth0 for MCP) and RFC 9728 protected-resource metadata on all seven MCP servers. It publishes no security.txt, no api-catalog, no ai-plugin and no agent card on any host. MCP-host OAuth discovery added 2026-09-19 (roadmap#321/#337): the harvest visits a provider''s primary hosts, and RFC 9728 protected-resource metadata lives on the MCP host, so these documents existed and were invisible to the scorer. Fetched live and validated on `resource`/`issuer`; one negative control per host.' not_found: - host: lukka.tech path: /.well-known/security.txt status: 404 - host: lukka.tech path: /.well-known/api-catalog status: 404 - host: lukka.tech path: /.well-known/ai-plugin.json status: 404 - host: lukka.tech path: /.well-known/agent-card.json status: 404 - host: lukka.tech path: /.well-known/agent.json status: 404 - host: lukka.tech path: /.well-known/openid-configuration status: 404 - host: data-pricing-api.lukka.tech path: /.well-known/security.txt status: 404 - host: data-pricing-api.lukka.tech path: /.well-known/api-catalog status: 404 - host: data-pricing-api.lukka.tech path: /.well-known/ai-plugin.json status: 404 - host: data-pricing-api.lukka.tech path: /.well-known/agent-card.json status: 404 - host: data-pricing-api.lukka.tech path: /.well-known/agent.json status: 404 - host: data-pricing-api.lukka.tech path: /.well-known/openid-configuration status: 404 - host: data-refdata-api.lukka.tech path: /.well-known/security.txt status: 404 - host: data-refdata-api.lukka.tech path: /.well-known/api-catalog status: 404 - host: data-refdata-api.lukka.tech path: /.well-known/ai-plugin.json status: 404 - host: data-refdata-api.lukka.tech path: /.well-known/agent-card.json status: 404 - host: data-refdata-api.lukka.tech path: /.well-known/agent.json status: 404 - host: data-refdata-api.lukka.tech path: /.well-known/openid-configuration status: 404 - host: data-analytics-api-v2.lukka.tech path: /.well-known/security.txt status: 404 - host: data-analytics-api-v2.lukka.tech path: /.well-known/api-catalog status: 404 - host: data-analytics-api-v2.lukka.tech path: /.well-known/ai-plugin.json status: 404 - host: data-analytics-api-v2.lukka.tech path: /.well-known/agent-card.json status: 404 - host: data-analytics-api-v2.lukka.tech path: /.well-known/agent.json status: 404 - host: data-analytics-api-v2.lukka.tech path: /.well-known/openid-configuration status: 404 - host: data-calculation-api.lukka.tech path: /.well-known/security.txt status: 404 - host: data-calculation-api.lukka.tech path: /.well-known/api-catalog status: 404 - host: data-calculation-api.lukka.tech path: /.well-known/ai-plugin.json status: 404 - host: data-calculation-api.lukka.tech path: /.well-known/agent-card.json status: 404 - host: data-calculation-api.lukka.tech path: /.well-known/agent.json status: 404 - host: data-calculation-api.lukka.tech path: /.well-known/openid-configuration status: 404 - host: api.lukka.tech path: /.well-known/security.txt status: 404 - host: api.lukka.tech path: /.well-known/api-catalog status: 404 - host: api.lukka.tech path: /.well-known/ai-plugin.json status: 404 - host: api.lukka.tech path: /.well-known/agent-card.json status: 404 - host: api.lukka.tech path: /.well-known/agent.json status: 404 - host: api.lukka.tech path: /.well-known/openid-configuration status: 404 - host: apidocs.lukka.tech path: /.well-known/security.txt status: 404 - host: apidocs.lukka.tech path: /.well-known/api-catalog status: 404 - host: apidocs.lukka.tech path: /.well-known/ai-plugin.json status: 404 - host: apidocs.lukka.tech path: /.well-known/agent-card.json status: 404 - host: apidocs.lukka.tech path: /.well-known/agent.json status: 404 - host: apidocs.lukka.tech path: /.well-known/openid-configuration status: 404 x-evidence: fetched: '2026-08-04' hosts: - host: '' documents: - path: /.well-known/openid-configuration status: 200 file: lukka-openid-configuration.json - path: /.well-known/oauth-authorization-server status: 200 file: lukka-oauth-authorization-server.json - path: /oauth2/aus1imo2fqcx5Ik4Q0h8/.well-known/oauth-authorization-server status: 200 file: lukka-pricing-oauth-authorization-server.json - path: /oauth2/aus1imo2g7ugEl49C0h8/.well-known/oauth-authorization-server status: 200 file: lukka-refdata-oauth-authorization-server.json - path: /.well-known/oauth-authorization-server status: 200 file: lukka-auth0-oauth-authorization-server.json - path: /.well-known/openid-configuration status: 200 file: lukka-auth0-openid-configuration.json - path: /.well-known/oauth-protected-resource status: 200 file: lukka-pricing-mcp-oauth-protected-resource.json - path: /.well-known/oauth-protected-resource status: 200 file: lukka-refdata-mcp-oauth-protected-resource.json - path: /.well-known/oauth-protected-resource status: 200 file: lukka-aml-mcp-oauth-protected-resource.json - path: /.well-known/oauth-protected-resource status: 200 file: lukka-uda-mcp-oauth-protected-resource.json - path: /.well-known/oauth-protected-resource status: 200 file: lukka-analytics-mcp-oauth-protected-resource.json - path: /.well-known/oauth-protected-resource status: 200 file: lukka-news-mcp-oauth-protected-resource.json - path: /.well-known/oauth-protected-resource status: 200 file: lukka-predmar-mcp-oauth-protected-resource.json - host: https://pricing.mcp.lukka.tech documents: - path: /.well-known/oauth-protected-resource status: 200 file: lukka-pricing-oauth-protected-resource.json bytes: 125 path_echo_control: passed - host: https://auth0.lukka.tech documents: - path: /.well-known/oauth-authorization-server status: 200 file: lukka-auth0-oauth-authorization-server.json bytes: 2586 path_echo_control: passed x-shape-fix: converted: '2026-08-20' from: documents note: Rewritten into hosts[] -> documents[], the only shape well_known_docs() in score.rb reads. A served .well-known surface recorded in any other shape scores as absent. x-mcp-probe: probed: '2026-09-19' issue: roadmap#321, roadmap#337 documents: - host: https://pricing.mcp.lukka.tech path: /.well-known/oauth-protected-resource file: lukka-pricing-oauth-protected-resource.json - host: https://auth0.lukka.tech path: /.well-known/oauth-authorization-server file: lukka-auth0-oauth-authorization-server.json validated_on: resource (RFC 9728) / issuer (RFC 8414, OIDC) negative_control: one per host; a 2xx JSON object at an impossible path discards the host