generated: '2026-09-11' method: probed source: >- live probes of /.well-known/* across every apis.yml host, every OpenAPI servers[] host, the docs/console host, and the hosts named by the docs host's own RFC 8288 Link header hosts_probed: - platform-api.sarj.ai - platform-docs.sarj.ai - www.sarj.ai - sarj.ai - platform.sarj.ai - blog.sarj.ai - stt-rnnt-ar.sarj.ai - sarj-omni-tts.sarj.ai discovery_lead: source: RFC 8288 Link header on https://platform-docs.sarj.ai header: >- ; rel="llms-txt", ; rel="llms-full-txt", ; rel="api-catalog", ; rel="mcp-server-card", ; rel="agent-card", ; rel="agent-skills" note: >- The docs host advertises six discovery documents in a Link header on every response. Probing that list is what surfaced the MCP server card and the agent-skills index, neither of which the 2026-08 pass found because neither is on the conventional probe list. It also surfaced a broken advertisement — see findings.api-catalog-advertised-but-404. hosts: - host: platform-api.sarj.ai documents: - path: /.well-known/oauth-authorization-server status: 200 file: sarj-ai-developer-api-oauth-authorization-server.json content_type: application/json note: >- RFC 8414 authorization-server metadata backing the hosted MCP server's browser sign-in flow. Advertises dynamic client registration (RFC 7591) and PKCE S256, with public clients (token_endpoint_auth_methods_supported = ["none"]). Re-fetched 2026-09-11, unchanged. - path: /.well-known/oauth-protected-resource status: 404 - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 404 - path: /.well-known/api-catalog status: 404 - path: /.well-known/ai-plugin.json status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/agent.json status: 404 - host: platform-docs.sarj.ai documents: - path: /.well-known/agent-card.json status: 200 file: ../a2a/sarj-ai-developer-api-agent-card.json content_type: application/json note: >- A2A agent card. Indexed here, saved verbatim and graded under a2a/. Re-fetched 2026-09-11 — the skill description was rewritten by the provider to cover scheduling and retries. - path: /.well-known/mcp/server-card.json status: 200 file: sarj-ai-developer-api-mcp-server-card.json content_type: application/json note: >- NEW since the 2026-08 pass. An MCP server card for a SECOND, documentation-facing MCP server ("Sarj.ai Docs MCP") that requires no authentication at all. Declares two tools; the live tools/list returns three. Saved under mcp/. - path: /.well-known/agent-skills/index.json status: 200 file: sarj-ai-developer-api-agent-skills-index.json content_type: application/json note: >- NEW since the 2026-08 pass. An agentskills.io discovery/0.2.0 document listing one skill with a sha256 digest. The digest published here (sha256:856e9f515005ebfd4e5b9cc6e522f9b43aa64d057f9727ec289f97e24103b528) matches the skill.md we harvested byte-for-byte — a verifiable integrity claim, which is rare. - path: /.well-known/agent-skills/sarj/skill.md status: 200 file: ../skills/sarj-ai-developer-api-sarj.md content_type: text/markdown; charset=utf-8 note: Provider-published Agent Skill, referenced by both the agent card and the skills index. - path: /.well-known/api-catalog status: 404 note: >- Advertised in the host's own Link header as rel="api-catalog" but returns 404 with a 9-byte text/plain body. A dangling advertisement, not a served document — no APICatalog pointer emitted. - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 308 note: 308 to / — the docs host redirects unknown paths to the index rather than 404ing them. - path: /.well-known/oauth-authorization-server status: 404 - path: /.well-known/oauth-protected-resource status: 404 - path: /.well-known/ai-plugin.json status: 404 - path: /.well-known/agent.json status: 404 - host: www.sarj.ai documents: - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 404 - path: /.well-known/oauth-authorization-server status: 404 - path: /.well-known/oauth-protected-resource status: 404 - path: /.well-known/api-catalog status: 404 - path: /.well-known/ai-plugin.json status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/agent.json status: 404 - host: sarj.ai documents: - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 404 - path: /.well-known/api-catalog status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/agent.json status: 404 - host: platform.sarj.ai documents: - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 403 - path: /.well-known/oauth-authorization-server status: 403 - path: /.well-known/api-catalog status: 403 - path: /.well-known/agent-card.json status: 403 note: >- The dashboard host answers 403 (4830-byte HTML challenge page) for every /.well-known/* path. Recorded as inconclusive rather than absent — an edge policy turning our crawler away, not a stated absence. - host: blog.sarj.ai documents: - path: /.well-known/security.txt status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/api-catalog status: 404 - host: stt-rnnt-ar.sarj.ai documents: - path: /.well-known/security.txt status: 401 - path: /.well-known/agent-card.json status: 401 - path: /.well-known/api-catalog status: 401 note: >- The speech hosts require a bearer key on every path including /.well-known/*, so nothing there is publicly discoverable. Their OpenAPI at /openapi.json is the exception and answers anonymously. - host: sarj-omni-tts.sarj.ai documents: - path: /.well-known/security.txt status: 401 - path: /.well-known/agent-card.json status: 401 - path: /.well-known/api-catalog status: 401 false_positives_rejected: - url: https://platform-docs.sarj.ai/.well-known/openid-configuration status: 308 reason: >- In the 2026-08 pass this path returned 200 with the 203368-byte Mintlify SPA shell and was correctly rejected as a soft 404. The docs host now answers 308 to / instead, which is an improvement — the soft 200 is gone. findings: - id: api-catalog-advertised-but-404 detail: >- platform-docs.sarj.ai advertises ; rel="api-catalog" on every response and serves a 404 there. This is the cheapest fix on the whole surface: the provider already believes it publishes an API catalog. Until it does, no APICatalog/WellKnown credit is claimed for that path. - id: two-agent-surfaces-one-host detail: >- platform-docs.sarj.ai now serves four live agent-facing discovery documents — agent card, MCP server card, agent-skills index and the skill itself — while the API host serves only OAuth metadata. The agent surface and the API surface are on different hosts, which is why a probe limited to the API host finds almost nothing. x-evidence: fetched: '2026-09-11' probes: 80 hits: 4