generated: '2026-08-13'
method: searched
source: live probe of /.well-known/ on every Notch host (app, www, apex)
hosts:
- host: https://app.usenotch.ai
  documents:
  - path: /.well-known/mcp/server-card.json           # MCP server card
    status: 200
    file: sesame-labs-mcp-server-card.json
  - path: /.well-known/oauth-authorization-server     # RFC 8414
    status: 200
    file: sesame-labs-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource       # RFC 9728
    status: 200
    file: sesame-labs-oauth-protected-resource.json
  - path: /.well-known/oauth-protected-resource/mcp   # RFC 9728 (MCP resource)
    status: 200
    file: sesame-labs-oauth-protected-resource-mcp.json
  - path: /.well-known/security.txt                   # RFC 9116
    status: 404
  - path: /.well-known/openid-configuration           # OIDC discovery
    status: 404
  - path: /.well-known/api-catalog                    # RFC 9727
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json                # A2A 1.0.0
    status: 404
  - path: /.well-known/agent.json                     # A2A legacy (pre-0.3)
    status: 404
- host: https://www.usenotch.ai
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: https://usenotch.ai
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
notes: >-
  Four real documents are served on app.usenotch.ai — the MCP server card plus
  the full OAuth 2.0 discovery set (RFC 8414 authorization-server metadata and
  RFC 9728 protected-resource metadata, both at the root and at the /mcp
  resource path). The server card advertises version 1.0.1 as of this probe
  (it was 1.0.0 on 2026-07-21). No security.txt, no OIDC discovery, no
  api-catalog, and no A2A agent card at either the canonical or the legacy
  path on any host. app.usenotch.ai answers a 404 status code with an HTML
  Next.js shell for misses, so every miss above was confirmed on the status
  code, not the body.
checked: '2026-08-13'