generated: '2026-08-01'
method: probed
source: live GET of /.well-known/* on every Mollie host in apis.yml and OpenAPI servers[]
hosts_probed:
- www.mollie.com
- mollie.com
- api.mollie.com
- docs.mollie.com
- mcp.mollie.com
- my.mollie.com
documents:
- host: https://www.mollie.com
  path: /.well-known/security.txt
  status: 200
  content_type: text/plain
  file: mollie-security.txt
  note: RFC 9116, PGP-signed, Expires 2026-09-01T13:37:00Z.
- host: https://mollie.com
  path: /.well-known/security.txt
  status: 200
  content_type: text/plain
  note: Identical document; both listed as Canonical in the file itself.
- host: https://mcp.mollie.com
  path: /.well-known/oauth-protected-resource
  status: 200
  content_type: application/json
  file: mollie-mcp-oauth-protected-resource.json
  note: >-
    RFC 9728 protected-resource metadata for the Mollie MCP server; delegates to
    https://my.mollie.com as the authorization server.
- host: https://my.mollie.com
  path: /.well-known/oauth-authorization-server
  status: 200
  content_type: application/json
  file: mollie-oauth-authorization-server.json
  note: >-
    RFC 8414 authorization-server metadata. Publishes 60 supported OAuth scopes, PKCE
    S256, dynamic client registration and authorization_code + refresh_token grants.
- host: https://api.mollie.com
  path: /.well-known/security.txt
  status: 404
- host: https://api.mollie.com
  path: /.well-known/oauth-authorization-server
  status: 404
- host: https://mcp.mollie.com
  path: /.well-known/oauth-authorization-server
  status: 404
- host: https://www.mollie.com
  path: /.well-known/openid-configuration
  status: 404
- host: https://www.mollie.com
  path: /.well-known/api-catalog
  status: 404
- host: https://www.mollie.com
  path: /.well-known/ai-plugin.json
  status: 404
- host: https://www.mollie.com
  path: /.well-known/agent-card.json
  status: 404
- host: https://www.mollie.com
  path: /.well-known/agent.json
  status: 404
- host: https://api.mollie.com
  path: /.well-known/agent-card.json
  status: 404
- host: https://mcp.mollie.com
  path: /.well-known/agent-card.json
  status: 404
- host: https://docs.mollie.com
  path: /.well-known/agent-card.json
  status: 404
findings:
  security_txt: true
  oauth_authorization_server: true
  oauth_protected_resource: true
  openid_configuration: false
  api_catalog: false
  ai_plugin: false
  a2a_agent_card: false