generated: '2026-08-25'
method: probed
source: >-
  Live probes of https://memo-therapeutics.com and https://memo-therapeutics.com/wp-json on
  2026-08-25, plus openapi/memo-therapeutics-*.yml derived from the site's own route index.
summary: >-
  Memo Therapeutics makes no conformance claim anywhere on its public surface. Everything below was
  established by fetching the thing and reading what came back. Three cross-cutting standards are
  genuinely implemented — oEmbed 1.0, RFC 8288 web linking and schema.org — and all three arrive
  through WordPress and its SEO plugin rather than through a deliberate API decision. No security,
  identity or industry standard is implemented, and no certification is published.
standards:
- id: oembed
  name: oEmbed 1.0
  conforms: true
  evidence: >-
    GET /wp-json/oembed/1.0/embed?url=https://memo-therapeutics.com/about-us/ -> 200 with
    {"version":"1.0","provider_name":"Memo Therapeutics","provider_url":"https://memo-therapeutics.com",
    "type":"rich",...}. Declared in the contract at
    openapi/memo-therapeutics-oembed-api-openapi.yml, operationId getOembed.
  spec: https://oembed.com/
- id: rfc8288
  name: RFC 8288 Web Linking
  conforms: true
  evidence: >-
    Collection responses return 'link: <...&page=2>; rel="next"', exposed to browsers via
    'access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link'. Observed on
    GET /wp-json/wp/v2/posts?per_page=1.
- id: schema-org
  name: schema.org structured data
  conforms: true
  evidence: >-
    One application/ld+json block on the homepage with @context https://schema.org and an @graph of
    BreadcrumbList, Organization, WebPage and WebSite. Emitted by All in One SEO v4.9.10.
- id: rss
  name: RSS 2.0
  conforms: true
  evidence: 'GET https://memo-therapeutics.com/feed/ -> 200, RSS 2.0 with content, dc, atom, sy and slash modules.'
- id: llmstxt
  name: llms.txt
  conforms: true
  evidence: >-
    GET https://memo-therapeutics.com/llms.txt -> 200, 44,125 bytes, generated by All in One SEO
    v4.9.10. Saved verbatim to llms/memo-therapeutics-llms.txt.
- id: rfc9457
  name: RFC 9457 Problem Details
  conforms: false
  evidence: >-
    Errors are application/json with a WordPress {code, message, data.status} envelope. No
    application/problem+json, no type URI, no title/instance. See
    errors/memo-therapeutics-problem-types.yml.
- id: rfc9116
  name: RFC 9116 security.txt
  conforms: false
  evidence: 'GET /.well-known/security.txt -> 404.'
- id: rfc8615
  name: RFC 8615 well-known URIs
  conforms: false
  evidence: >-
    No /.well-known document is served. Two paths return 200 with the homepage HTML rather than a
    document; see well-known/memo-therapeutics-well-known.yml.
- id: oauth2
  name: OAuth 2.0
  conforms: false
  evidence: 'No authorization server. /.well-known/oauth-authorization-server returns homepage HTML, not RFC 8414 metadata.'
- id: oidc
  name: OpenID Connect
  conforms: false
  evidence: 'GET /.well-known/openid-configuration -> 404.'
- id: rfc8594
  name: RFC 8594 Sunset header
  conforms: false
  evidence: No Sunset or Deprecation header on any observed response.
- id: idempotency-key
  name: Idempotency-Key
  conforms: na
  evidence: >-
    No anonymous write surface exists, so there is nothing to make idempotent. Recorded na rather
    than false. No Idempotency pointer is emitted in apis.yml.
- id: a2a
  name: A2A Agent Card
  conforms: false
  evidence: 'GET /.well-known/agent-card.json -> 404; GET /.well-known/agent.json -> 404.'
- id: mcp
  name: Model Context Protocol
  conforms: false
  evidence: >-
    No MCP endpoint. The WordPress Abilities API (wp-abilities/v1) and the All in One SEO MCP
    adapter route (aioseo/v1/ai-agents/mcp-adapter/release) are both registered on this deployment
    but return 401 to an anonymous client. See mcp/memo-therapeutics-mcp.yml.
domain_standard:
  declared: false
  sector: biotechnology / pharmaceuticals / clinical development
  candidates_checked:
  - HL7 FHIR / HL7v2 message types
  - CDISC SDTM / ODM
  - ICH E2B pharmacovigilance messages
  - ORCID / DataCite / Crossref identifier schemes
  - OAI-PMH verbs
  evidence: >-
    None of these appear anywhere in the contract, the route index, the response payloads or the
    site. The catalogued surface is a content API for a corporate website; it has no clinical,
    regulatory or research-data payload in which a sector standard could be declared. Recorded as
    absent, not as a failure — this is a reward-only check and there is nothing here to reward.
compliance:
  certifications_published: []
  trust_center: false
  evidence: >-
    probe-security-programs.py found no vulnerability-disclosure programme and no trust centre on
    2026-08-25. No SOC 2, ISO 27001, HIPAA, GxP or GDPR attestation is published on
    memo-therapeutics.com. The privacy policy and cookie policy exist; neither names a
    certification. No Compliance or TrustCenter pointer is emitted in apis.yml.