generated: '2026-08-09'
method: derived
source: openapi/*.json, well-known/*.json, live probes
standards:
- id: openapi-3.0
  conforms: true
  evidence: '38 documents served at /api/v1/{service}/openapi.json, each openapi: 3.0.0 with paths, components.schemas
    and securitySchemes.'
- id: mcp
  conforms: true
  evidence: 38 hosted remote MCP endpoints at https://connect.mcp360.ai/v1/{service}/mcp; JSON-RPC 2.0
    over HTTP, auth-gated.
- id: oauth2
  conforms: true
  evidence: RFC 8414 authorization-server metadata at https://api.mcp360.ai/.well-known/oauth-authorization-server;
    authorization_code grant.
- id: oauth2-pkce
  conforms: true
  evidence: 'code_challenge_methods_supported: [S256].'
- id: rfc7591-dynamic-client-registration
  conforms: true
  evidence: 'registration_endpoint: https://api.mcp360.ai/api/v1/oauth/register.'
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: https://connect.mcp360.ai/.well-known/oauth-protected-resource returns resource, authorization_servers,
    bearer_methods_supported and scopes_supported.
- id: oidc-discovery
  conforms: partial
  evidence: https://api.mcp360.ai/.well-known/openid-configuration returns 200 but omits jwks_uri, subject_types_supported
    and id_token_signing_alg_values_supported — it is the OAuth metadata document served at the OIDC path,
    not a conformant OIDC provider configuration.
- id: json-schema
  conforms: true
  evidence: Every one of the 106 tools publishes an inputSchema and outputSchema in JSON Schema form at
    GET /api/v1/{service}; captured in json-schema/mcp360-tool-schemas.json.
- id: llmstxt
  conforms: true
  evidence: https://mcp360.ai/llms.txt returns 200 text/plain with H1, blockquote summary and sectioned
    link lists.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a bespoke {error,message,hint} envelope with content-type application/json.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every host.
- id: rfc8594-sunset
  conforms: false
  evidence: No Sunset/Deprecation header support or policy published.
- id: a2a
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json return 404 on mcp360.ai, connect.mcp360.ai,
    api.mcp360.ai and help.mcp360.ai.
- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface is documented or discoverable.
- id: api-catalog
  conforms: false
  evidence: /.well-known/api-catalog returns 404, though GET https://connect.mcp360.ai/ returns a de-facto
    endpoint catalogue in its 404 body.
compliance_program:
  published: false
  evidence: No trust center, SOC 2 / ISO 27001 / PCI / HIPAA / GDPR certification claim, or compliance
    page found. trust.mcp360.ai and security.mcp360.ai do not resolve; https://mcp360.ai/security returns
    404.
  note: The GitHub README markets "Enterprise Security" but no certification or audit is published.