generated: '2026-08-29'
method: probed
source: >-
  Live probes of https://super73.com/.well-known/ucp, /.well-known/openid-configuration,
  /.well-known/oauth-protected-resource, /api/ucp/mcp and /api/2025-07/graphql.json, 2026-08-29
summary: >-
  SUPER73 conforms to a notably modern agent stack for a consumer hardware brand — MCP, UCP, OIDC and
  RFC 9728 are all live and anonymously verifiable — while publishing none of the classic API-provider
  standards (no OpenAPI, no AsyncAPI, no RFC 9457 problem details, no RFC 9116 security.txt).
standards:
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence: >-
    POST https://super73.com/api/ucp/mcp with {"jsonrpc":"2.0","id":1,"method":"tools/list"} returned
    HTTP 200 and a valid JSON-RPC 2.0 result containing 13 tools, each with a JSON Schema
    2020-12 inputSchema.
  method: probed
- id: ucp
  name: Universal Commerce Protocol
  version: '2026-08-25'
  conforms: true
  domain_standard: true
  evidence: >-
    https://super73.com/.well-known/ucp returns a UCP merchant profile declaring version 2026-08-25 plus
    two prior versions, the dev.ucp.shopping service over MCP transport, eight capabilities
    (cart, checkout, fulfillment, discount, order, catalog.search, catalog.lookup, dev.shopify.catalog)
    and three payment handlers (com.google.pay, dev.shopify.card, dev.shopify.shop_pay).
  method: probed
  note: >-
    This is the domain standard for SUPER73's market position — agentic retail commerce. A buyer's agent
    that already speaks UCP transacts with this store with no bespoke connector.
- id: jsonrpc-2.0
  name: JSON-RPC 2.0
  conforms: true
  evidence: The MCP endpoint accepts and returns well-formed JSON-RPC 2.0 envelopes.
  method: probed
- id: json-schema-2020-12
  name: JSON Schema draft 2020-12
  conforms: true
  evidence: Every tool inputSchema declares $schema https://json-schema.org/draft/2020-12/schema.
  method: probed
- id: oidc
  name: OpenID Connect Discovery 1.0
  conforms: true
  evidence: >-
    https://super73.com/.well-known/openid-configuration returns a valid discovery document with issuer,
    authorization_endpoint, token_endpoint, jwks_uri, RS256 id_token signing and four supported scopes.
  method: probed
- id: oauth2
  name: OAuth 2.0 Authorization Code with PKCE
  conforms: true
  evidence: >-
    code_challenge_methods_supported ["S256"], response_types ["code"], grant_types authorization_code /
    refresh_token / jwt-bearer, advertised at /.well-known/oauth-authorization-server.
  method: probed
- id: rfc8414
  name: RFC 8414 OAuth 2.0 Authorization Server Metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns HTTP 200 with the metadata document.
  method: probed
- id: rfc9728
  name: RFC 9728 OAuth 2.0 Protected Resource Metadata
  conforms: true
  evidence: >-
    /.well-known/oauth-protected-resource returns {"resource":"https://super73.com",
    "authorization_servers":["https://shopify.com/authentication/13743231"],
    "bearer_methods_supported":["header"]}.
  method: probed
- id: graphql
  name: GraphQL (June 2018 spec, Relay connections)
  conforms: true
  evidence: >-
    Anonymous introspection of https://super73.com/api/2025-07/graphql.json returned 422 types with
    Relay-style cursor connections.
  method: probed
- id: llmstxt
  name: llms.txt
  conforms: true
  evidence: >-
    https://super73.com/llms.txt returns HTTP 200 with a 4.2KB agent instruction document; the canonical
    copy at /agents.md is registered in a dedicated /sitemap_agentic_discovery.xml.
  method: probed
- id: openapi
  name: OpenAPI
  conforms: false
  evidence: >-
    /openapi.json, /openapi.yaml, /swagger.json and /api-docs all 404 on super73.com and eu.super73.com.
    No OpenAPI document is published for any SUPER73 surface.
  method: probed
- id: asyncapi
  name: AsyncAPI
  conforms: false
  evidence: No event, streaming or webhook surface is published for third parties. Not applicable.
  method: probed
- id: rfc9457
  name: RFC 9457 Problem Details
  conforms: false
  evidence: Errors are JSON-RPC error members and GraphQL errors/userErrors, not application/problem+json.
  method: probed
- id: rfc9116
  name: RFC 9116 security.txt
  conforms: false
  evidence: /.well-known/security.txt returns HTTP 404 on both super73.com and eu.super73.com.
  method: probed
- id: a2a
  name: A2A Agent Card
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json both return HTTP 404 (a real 404 page, not
    an SPA shell) on both storefront hosts.
  method: probed
compliance_certifications: []
compliance_note: >-
  SUPER73 publishes no trust center, no SOC 2 / ISO 27001 / PCI attestation page and no security
  disclosure policy. probe-security-programs.py returned vdp=none trust=none on 2026-08-29, so no
  Compliance, Security or TrustCenter pointer is emitted.