generated: '2026-08-29'
method: derived
source: >-
  openapi/spyderbat-openapi.json, https://docs.spyderbat.com/llms.txt,
  https://spyderbat.com/ (site and footer probed 2026-08-29)
note: >-
  Cross-cutting and domain standards asserted against the published contract and the
  public docs. Every `conforms: true` cites the exact spec location or docs URL that
  proves it. No compliance certification claim could be found anywhere on Spyderbat's
  public surface, so no `Compliance` and no `TrustCenter` pointer is emitted.
standards:
- id: openapi-3.0
  conforms: true
  evidence: >-
    openapi/spyderbat-openapi.json declares `openapi: 3.0.1` with 153 paths, 197
    operations and 226 component schemas; served live at
    https://api.spyderbat.com/openapi.json (HTTP 200).
- id: rfc6750-bearer
  conforms: true
  evidence: >-
    components.securitySchemes.apiToken is `type: http, scheme: bearer, bearerFormat: JWT`,
    applied globally via top-level `security: [{apiToken: []}]`. Docs confirm the header
    form `Authorization: Bearer <api-key>`.
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme in the contract; /.well-known/oauth-authorization-server and
    /.well-known/oauth-protected-resource both 404 on api.spyderbat.com. The MCP
    documentation states explicitly that "OAuth is not currently supported".
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every Spyderbat host.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    No application/problem+json media type appears anywhere in the contract. Only 400
    declares a JSON body (ValidationError); 403/404/409/422/429 declare no schema.
- id: pagination
  conforms: partial
  evidence: >-
    `page` and `page_size` query parameters on 14 operations, with `sort_by` and
    `reversed` for ordering. Not applied to most list operations; adhoc search uses an
    async job model instead.
- id: idempotency
  conforms: false
  evidence: >-
    No Idempotency-Key header, no idempotency parameter and no idempotency documentation
    anywhere in the contract or the docs — including on AgentKillPod, AgentKillProcess and
    AgentScanContainer, which take destructive action on a monitored host.
- id: rfc8594-sunset
  conforms: false
  evidence: >-
    No Sunset or Deprecation header is declared on any response and no operation carries
    `deprecated: true`.
- id: rfc9116-security-txt
  conforms: false
  evidence: >-
    /.well-known/security.txt 404s on every host; spyderbat.com returns a JSON 404 body
    {"message":"security.txt not found"}.
- id: rfc8615-well-known
  conforms: false
  evidence: >-
    No /.well-known/* path returns a document on any Spyderbat host. See
    well-known/spyderbat-well-known.yml.
- id: mcp
  conforms: true
  evidence: >-
    First-party remote MCP server documented at
    https://docs.spyderbat.com/installation/mcp.md, endpoint
    https://api.spyderbat.com/mcp/v1/mcp, streamable-HTTP transport. Anonymous tools/list
    returns HTTP 403 and the response advertises MCP-Protocol-Version and Mcp-Session-Id
    in access-control-allow-headers, confirming a live MCP implementation.
- id: a2a
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json 404 on api.spyderbat.com,
    spyderbat.com and docs.spyderbat.com. app.spyderbat.com answers 200 for every path
    with the console SPA HTML shell, which is not an agent card.
- id: llms-txt
  conforms: true
  evidence: >-
    https://docs.spyderbat.com/llms.txt returns HTTP 200 with a real 89-line llms.txt
    index of 89 documentation pages. Every page is additionally available as Markdown by
    appending `.md` to its URL — a genuine agent-readable docs surface.
- id: graphql
  conforms: false
  evidence: No /graphql surface exists on any Spyderbat host and none is documented.
- id: grpc-protobuf
  conforms: false
  evidence: No .proto is published in the spyderbat GitHub org or referenced in the docs.
- id: soap-wsdl
  conforms: false
  evidence: '?wsdl returns 404 on api.spyderbat.com and api.prod.spyderbat.com.'
- id: asyncapi
  conforms: false
  evidence: >-
    No AsyncAPI document is published, although a real event surface exists — see
    asyncapi/spyderbat-events-webhooks.yml.
domain_standards:
  sector: cybersecurity / cloud detection and response
  note: >-
    Reward-only. Spyderbat's market has real interchange standards, and the contract
    declares one of them plainly while the others are absent.
  standards:
  - id: mitre-attack
    conforms: true
    evidence: >-
      Red flags carry MITRE ATT&CK tactic and technique identifiers. The MCP
      documentation shows detections labelled TA0004.T1548 (root_shell), TA0008.T1021
      (ssh_inside_container_detection) and TA0005.T1610 (nonk8s_container_detection) —
      the standard technique taxonomy for this sector, present in the returned data rather
      than only claimed in marketing copy.
    location: event_redflag search schema; https://docs.spyderbat.com/installation/mcp.md
  - id: ocsf
    conforms: false
    evidence: >-
      No Open Cybersecurity Schema Framework class_uid, category_uid or activity_id
      appears in any of the 226 schemas or in the search-field reference. Forwarded SIEM
      events are Spyderbat-native schema objects (model_spydertrace, model_connection,
      event_redflag), so a SIEM consumer needs a Spyderbat-specific connector rather than
      an OCSF one.
  - id: stix-taxii
    conforms: false
    evidence: No STIX bundle or TAXII endpoint is exposed or documented.
  - id: cyclonedx-spdx
    conforms: false
    evidence: No SBOM format is produced or consumed by the published API.
  - id: cve-cvss
    conforms: false
    evidence: >-
      No CVE identifier or CVSS vector field appears in the contract. Spyderbat's
      detection model is behavioral/runtime rather than vulnerability-scanner shaped, so
      this is an absence of applicability rather than a gap.
  - id: falco-rules
    conforms: partial
    evidence: >-
      Not in the API contract, but Spyderbat publishes github.com/spyderbat/rules ("Falco
      rule repository") and github.com/spyderbat/falcosidekick, and documents a Falco
      connector deployment at
      https://docs.spyderbat.com/tutorials/integrations/falco-connector-deployment. The
      interop is at the integration layer, not in the REST contract.
  - id: syslog-rfc5424
    conforms: partial
    evidence: >-
      The Event Forwarder writes to syslog as one of its four destinations (file, webhook,
      stdout, syslog) per
      https://docs.spyderbat.com/concepts/integrations/siem-forwarding.md. The syslog
      profile itself is not specified in the docs.
compliance_certifications:
  published: false
  probed:
  - url: https://trust.spyderbat.com/
    status: 000
    note: DNS does not resolve.
  - url: https://spyderbat.com/security/
    status: 404
  - url: https://spyderbat.com/privacy-en
    status: 200
    note: Privacy statement only; names no certification.
  note: >-
    No SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP claim appears anywhere on Spyderbat's
    public site, in the docs index, or in the API contract. This is a notable gap for a
    security vendor selling to security teams, and it is why no `Compliance` pointer is
    emitted. It is a recorded absence, not an assertion that no certification exists.