generated: '2026-08-26'
method: probed
source: >-
  https://mudwtr.com/.well-known/ucp, https://mudwtr.com/.well-known/oauth-authorization-server,
  https://mudwtr.com/.well-known/oauth-protected-resource, live MCP initialize/tools/list and GraphQL
  introspection probes on 2026-08-26
description: >-
  Cross-cutting and domain standards MUD\WTR's own contracts declare. Everything below is evidenced by
  a document served from a mudwtr.com URL or by a live response from a mudwtr.com endpoint; nothing is
  taken from a marketing claim.
standards:
- id: ucp
  name: Universal Commerce Protocol
  version: '2026-04-08'
  conforms: true
  domain_standard: true
  sector: commerce
  evidence:
    url: https://mudwtr.com/.well-known/ucp
    status: 200
    detail: >-
      The merchant profile declares ucp.version 2026-04-08 with supported_versions 2026-04-08 and
      2026-01-23, a dev.ucp.shopping service with transport "mcp" and endpoint /api/ucp/mcp, and
      capability URNs dev.ucp.shopping.checkout, .cart, .order, .fulfillment, .discount,
      .catalog.search and .catalog.lookup, each bound to a ucp.dev JSON Schema. The live server
      echoes the version in the x-shopify-ucp-mcp-api-version response header.
- id: mcp
  name: Model Context Protocol
  version: '2025-06-18'
  conforms: true
  evidence:
    url: https://mudwtr.com/api/ucp/mcp
    status: 200
    detail: >-
      initialize returned protocolVersion 2025-06-18 with serverInfo universal-commerce 0.1.0 and
      tools/prompts/resources/logging capabilities. https://mudwtr.com/api/mcp returned the same
      protocol version with serverInfo storefront-renderer 0.1.0.
- id: jsonrpc2
  name: JSON-RPC 2.0
  conforms: true
  evidence:
    url: https://mudwtr.com/api/ucp/mcp
    status: 200
    detail: All MCP responses carry jsonrpc "2.0" with matching id, and errors use the standard code/message/data envelope.
- id: json-schema
  name: JSON Schema 2020-12
  conforms: true
  evidence:
    url: https://mudwtr.com/api/ucp/mcp
    status: 200
    detail: Every tool inputSchema declares $schema https://json-schema.org/draft/2020-12/schema.
- id: graphql
  name: GraphQL
  conforms: true
  evidence:
    url: https://mudwtr.com/api/2025-10/graphql.json
    status: 200
    detail: Full introspection returned 414 types, 34 query root fields and 41 mutations.
- id: relay-cursor-connections
  name: GraphQL Cursor Connections (Relay)
  conforms: true
  evidence:
    url: graphql/mud-wtr-storefront.graphql
    detail: >-
      Collection fields expose first/after/last/before with *Connection types carrying pageInfo and
      edges/node.
- id: oauth2
  name: OAuth 2.0 Authorization Server Metadata (RFC 8414)
  conforms: true
  evidence:
    url: https://mudwtr.com/.well-known/oauth-authorization-server
    status: 200
    detail: Serves issuer, authorization_endpoint, token_endpoint, jwks_uri, scopes_supported, grant_types_supported.
- id: oauth2-pkce
  name: PKCE (RFC 7636)
  conforms: true
  evidence:
    url: https://mudwtr.com/.well-known/oauth-authorization-server
    status: 200
    detail: code_challenge_methods_supported ["S256"].
- id: rfc9728
  name: OAuth 2.0 Protected Resource Metadata (RFC 9728)
  conforms: true
  evidence:
    url: https://mudwtr.com/.well-known/oauth-protected-resource
    status: 200
    detail: 'resource https://mudwtr.com, authorization_servers [account.mudwtr.com, shopify.com/authentication/13794345014], bearer_methods_supported ["header"].'
- id: oidc
  name: OpenID Connect Discovery
  conforms: true
  evidence:
    url: https://mudwtr.com/.well-known/openid-configuration
    status: 200
    detail: >-
      Serves id_token_signing_alg_values_supported RS256, subject_types_supported public and the
      standard claims set. Byte-identical to the oauth-authorization-server document.
- id: llms-txt
  name: llms.txt
  conforms: true
  evidence:
    url: https://mudwtr.com/llms.txt
    status: 200
    detail: text/markdown agent contract mirroring /agents.md; also listed in sitemap_agentic_discovery.xml.
- id: rfc9457
  name: Problem Details for HTTP APIs (RFC 9457)
  conforms: false
  evidence:
    detail: >-
      No application/problem+json response was observed on any surface. Errors use the JSON-RPC error
      envelope on MCP and the GraphQL errors[] envelope with extensions.code on GraphQL.
- id: openapi
  name: OpenAPI
  conforms: false
  evidence:
    url: https://mudwtr.com/openapi.json
    status: 404
    detail: >-
      No OpenAPI or Swagger document at /openapi.json, /openapi.yaml, /swagger.json, /api-docs or
      /.well-known/api-catalog on any MUD\WTR host.
- id: a2a
  name: A2A Agent Card
  conforms: false
  evidence:
    url: https://mudwtr.com/.well-known/agent-card.json
    status: 404
    detail: HTML 404 at both /.well-known/agent-card.json and the legacy /.well-known/agent.json.
- id: security-txt
  name: security.txt (RFC 9116)
  conforms: false
  evidence:
    url: https://mudwtr.com/.well-known/security.txt
    status: 404
compliance:
  published_certifications: []
  note: >-
    No trust center, SOC 2/ISO 27001/PCI attestation page or vulnerability-disclosure program was
    found on any mudwtr.com host; probe-security-programs reported vdp=none trust=none. No
    Compliance pointer was emitted.