generated: '2026-08-14'
method: probed
source: live GET of /.well-known/* on every apis.yml + discovered host
name: RingDNA / Revenue.io well-known discovery surface
description: >-
  Probe of the RFC 8615 well-known surface across every host named in apis.yml
  (api.ringdna.com, www.revenue.io, support.revenue.io, ringdna.com) plus the two
  hosts discovered during contract discovery (app.ringdna.com, api.revenue.io).
  The real hits are the OAuth discovery documents that front the undocumented
  RingDNA MCP server at https://app.ringdna.com/mcp - RFC 8414 authorization
  server metadata and RFC 9728 protected resource metadata, both anonymous.
  No security.txt, no OpenID Connect discovery, no api-catalog, no ai-plugin,
  and no A2A agent card is served on any host.
hosts:
  - host: app.ringdna.com
    note: Revenue.io application host; serves the MCP server and its OAuth metadata.
    documents:
      - path: /.well-known/oauth-authorization-server
        status: 200
        content_type: application/json
        file: ringdna-oauth-authorization-server.json
        spec: RFC 8414
      - path: /.well-known/oauth-protected-resource
        status: 200
        content_type: application/json
        file: ringdna-oauth-protected-resource.json
        spec: RFC 9728
      - path: /.well-known/oauth-protected-resource/mcp
        status: 200
        content_type: application/json
        spec: RFC 9728
        note: >-
          Path-suffixed variant named by the WWW-Authenticate challenge on
          POST https://app.ringdna.com/mcp; identical body to the root document.
      - path: /.well-known/openid-configuration
        status: 404
      - path: /.well-known/security.txt
        status: 404
      - path: /.well-known/api-catalog
        status: 404
      - path: /.well-known/agent-card.json
        status: 404
      - path: /.well-known/agent.json
        status: 404
      - path: /llms.txt
        status: 404
  - host: api.revenue.io
    note: >-
      Resolves and answers; root 302s to https://app.revenue.io/. Serves the same
      MCP authorization-server metadata as app.ringdna.com (issuer is
      https://app.ringdna.com), which is how the MCP server was first discovered.
    documents:
      - path: /.well-known/oauth-authorization-server
        status: 200
        content_type: application/json
        spec: RFC 8414
        note: Byte-identical to app.ringdna.com; issuer points at app.ringdna.com.
      - path: /.well-known/oauth-protected-resource
        status: 404
      - path: /.well-known/openid-configuration
        status: 404
      - path: /.well-known/security.txt
        status: 404
      - path: /.well-known/api-catalog
        status: 404
      - path: /.well-known/ai-plugin.json
        status: 404
      - path: /.well-known/agent-card.json
        status: 404
      - path: /.well-known/agent.json
        status: 404
  - host: www.revenue.io
    note: Marketing site. Every /.well-known/* path returns the 404 HTML page.
    documents:
      - path: /.well-known/security.txt
        status: 404
      - path: /.well-known/openid-configuration
        status: 404
      - path: /.well-known/oauth-authorization-server
        status: 404
      - path: /.well-known/api-catalog
        status: 404
      - path: /.well-known/ai-plugin.json
        status: 404
      - path: /.well-known/agent-card.json
        status: 404
      - path: /.well-known/agent.json
        status: 404
      - path: /llms.txt
        status: 200
        content_type: text/plain
        file: ../llms/ringdna-llms.txt
        note: Real llms.txt, generated by Yoast SEO v28.0. Saved verbatim.
  - host: ringdna.com
    note: 301s to www.revenue.io; same 404 behaviour on /.well-known/*.
    documents:
      - path: /.well-known/security.txt
        status: 404
      - path: /.well-known/agent-card.json
        status: 404
      - path: /.well-known/agent.json
        status: 404
      - path: /llms.txt
        status: 200
        note: Serves the www.revenue.io llms.txt after redirect.
  - host: support.revenue.io
    note: >-
      SOFT-404 HOST - DO NOT CREDIT. This Hugo documentation site answers HTTP 200
      with the same 919KB HTML shell for every /.well-known/* path probed,
      including agent-card.json and agent.json. None of these responses is a
      document; all are treated as misses.
    documents:
      - path: /.well-known/security.txt
        status: 200
        content_type: text/html
        document: false
        note: HTML shell, not a security.txt. Soft-404.
      - path: /.well-known/agent-card.json
        status: 200
        content_type: text/html
        document: false
        note: HTML shell, not an agent card. Soft-404. Rejected per pipeline rule.
      - path: /.well-known/agent.json
        status: 200
        content_type: text/html
        document: false
        note: HTML shell. Soft-404. Rejected.
      - path: /.well-known/oauth-authorization-server
        status: 200
        content_type: text/html
        document: false
        note: HTML shell. Soft-404.
  - host: api.ringdna.com
    note: >-
      NXDOMAIN - the host published as the Guided Selling API baseURL in apis.yml
      has no DNS record at all. No /.well-known/* probe could be performed.
    documents: []
summary:
  hosts_probed: 6
  real_documents: 3
  document_types:
    - oauth-authorization-server
    - oauth-protected-resource
    - llms.txt
  security_txt: false
  agent_card: false
  openid_configuration: false
  api_catalog: false