generated: '2026-09-19' method: searched source: https://api.rosentic.com/.well-known/oauth-authorization-server docs: - https://rosentic.com/mcp/ - https://rosentic.com/trust/ - https://rosentic.com/blog/your-code-is-never-stored/ summary: >- Rosentic's conformance profile is the agent-protocol and OAuth stack, all of it verified from documents the provider serves: RFC 8414 authorization-server metadata, RFC 9728 protected-resource metadata (the MCP authorization discovery chain, exercised end to end by the endpoint's own WWW-Authenticate challenge), RFC 7591 dynamic client registration, RFC 7636 PKCE, OAuth 2.1 public-client shape, an A2A 0.3.0 agent card with a live JSON-RPC 2.0 responder, and a Streamable-HTTP MCP server whose protocol version is auth-gated. It declares no OIDC, no RFC 9116 security.txt, no RFC 9457 problem details, no RFC 9727 API catalog and no RFC 8594 sunset signalling, and publishes no SOC 2 / ISO 27001 or similar certification — the /trust page is a data-boundary statement, not a compliance program — so no Compliance pointer is emitted. Developer tooling has no domain standard to sign, so domain_standard_conformance is honestly absent rather than filled. standards: - id: rfc8414-oauth-authorization-server-metadata name: OAuth 2.0 Authorization Server Metadata conforms: true evidence: 'GET https://api.rosentic.com/.well-known/oauth-authorization-server -> 200 application/json; issuer https://api.rosentic.com; authorization_endpoint, token_endpoint, registration_endpoint, response_types_supported [code], grant_types_supported [authorization_code, refresh_token], code_challenge_methods_supported [S256], scopes_supported [rosentic:remote:read]. Saved: well-known/rosentic-com-oauth-authorization-server.json.' - id: rfc9728-oauth-protected-resource-metadata name: OAuth 2.0 Protected Resource Metadata conforms: true evidence: 'GET https://api.rosentic.com/.well-known/oauth-protected-resource (and the path-suffixed /oauth-protected-resource/mcp) -> 200; resource https://api.rosentic.com/mcp, authorization_servers [https://api.rosentic.com], bearer_methods_supported [header], scopes_supported [rosentic:remote:read]. The MCP 401 carries WWW-Authenticate Bearer resource_metadata="…/oauth-protected-resource/mcp", scope="rosentic:remote:read" — the RFC 9728 section 5.1 challenge.' - id: rfc7591-dynamic-client-registration name: OAuth 2.0 Dynamic Client Registration conforms: true evidence: 'registration_endpoint https://api.rosentic.com/oauth/register in the AS metadata; POST {} -> 400 {"error":"invalid_client_metadata","error_description":"redirect_uris must contain 1 to 10 HTTPS or loopback HTTP URIs without fragments"} — an RFC 7591 section 3.2.2 error code. No client was registered.' - id: rfc7636-pkce name: Proof Key for Code Exchange conforms: true evidence: code_challenge_methods_supported [S256] with token_endpoint_auth_methods_supported [none] — the OAuth 2.1 public-client profile. - id: oauth2.1 name: OAuth 2.1 (draft) profile conforms: true verification: partial evidence: 'Provider claim on https://rosentic.com/llms.txt ("OAuth 2.1, PKCE, dynamic client registration") matched by the metadata: authorization_code + PKCE only, no implicit or password grant, refresh_token supported. Not exercised end to end (no authorization was performed).' - id: mcp-authorization name: MCP Authorization specification (RFC 9728 discovery from the resource server) conforms: true evidence: 'Anonymous POST tools/list to https://api.rosentic.com/mcp -> 401 with the resource_metadata challenge and a JSON-RPC -32001 error body; CORS allows MCP-Protocol-Version and Mcp-Session-Id headers. Protocol version and serverInfo are behind the gate and were not read.' - id: a2a name: Agent2Agent protocol version: '0.3.0' conforms: true evidence: 'a2a/rosentic-com-agent-card.json — protocolVersion "0.3.0", url https://api.rosentic.com/a2a, capabilities object, skills[] of 5; POST https://api.rosentic.com/a2a tasks/get answered JSON-RPC error "Task not found" (code -32004, where the spec says -32001). Graded near-conformant (preferredTransport omitted; legacy authentication block) in a2a/rosentic-com-a2a.yml.' - id: json-rpc-2.0 conforms: true evidence: 'Both /mcp and /a2a answer {"jsonrpc":"2.0", …} with -32601 Method not found for unimplemented methods and -32001 for the auth failure.' - id: rfc6750-bearer name: OAuth 2.0 Bearer Token Usage conforms: true evidence: bearer_methods_supported [header]; docs use Authorization Bearer $ROSENTIC_API_KEY on the feed endpoint and the MCP endpoint. - id: oidc-discovery conforms: false evidence: 'GET https://api.rosentic.com/.well-known/openid-configuration -> 404. Dashboard identity is delegated to GitHub OAuth (read:org read:user user:email) or magic-link email; Rosentic issues no ID tokens.' - id: rfc9116-security-txt conforms: false evidence: 'https://api.rosentic.com/.well-known/security.txt -> 404; https://rosentic.com/.well-known/security.txt -> catch-all HTML shell.' - id: rfc9457-problem-details conforms: false evidence: 'Error bodies are {"error":"not_found"} (API host) or {"error":"","error_description":"…"} (OAuth endpoints, RFC 6749 shape) or JSON-RPC error objects; the documented REST table uses {status, error} codes such as plan_required. No application/problem+json.' - id: rfc9727-api-catalog conforms: false evidence: 'https://api.rosentic.com/.well-known/api-catalog -> 404.' - id: rfc8594-sunset conforms: false evidence: No Sunset or Deprecation header documented; no deprecation policy page (see lifecycle/). - id: openapi conforms: false evidence: 'No OpenAPI at api.rosentic.com/openapi.json, /openapi.yaml, /swagger.json, /v1/openapi.json, /api-docs, /docs, /redoc (all JSON 404) or on the apex (catch-all shell). The REST surface is documented in prose at https://rosentic.com/docs/integrations/ only.' domain_standard_conformance: applicable: false note: >- Developer tooling / CI has no sector standard (no SCIM, OData, FHIR, OpenRTB, LTI or similar analogue), and the scorer's regime map lists none for this sector. Rosentic READS OpenAPI, GraphQL and Protobuf contracts as inputs to its engine (detection layers L3a–L3c) but does not itself expose an API in any of those shapes. Reward-only check; left empty on purpose. compliance_program: published: false evidence: >- https://rosentic.com/trust/ (200, 4,771 bytes) is a data-boundary page — "the engine goes to the code, the code never goes to the engine", three telemetry tiers (anonymous: names + SHAs hashed on the runner; keyed: itemized scan metadata, never source; VPC: nothing leaves) — with no certification, audit report or framework named. The 2026-03-24 post "Your code is never stored" adds supply-chain controls (2FA on maintainer accounts, image pinned by SHA digest, GITHUB_TOKEN only, no outbound calls from the engine). Real security posture, not a compliance program: no Compliance pointer.