generated: '2026-09-19'
method: searched
source: SEARCHED the provider surface (agent card, auth.md, llms.txt, robots.txt, the discovery documents in well-known/, the website pages) and PROBED the endpoints anonymously on 2026-09-19. There is no OpenAPI to derive from; nothing below is asserted that a fetched document or an observed response does not show.
standards:
- id: a2a-agent-card
  conforms: true
  evidence: https://www.sursatech.com/.well-known/agent-card.json (and byte-identical on api.sursatech.com) 200 application/json; protocolVersion "1.0"; graded conformant against the A2A 1.0.0 hard checks — capabilities is an object, protocolVersion present, skills is a 10-item array (a2a/sursatech-com-a2a.yml).
- id: a2a-protocol-1.0-jsonrpc
  conforms: true
  partial: true
  evidence: 'POST https://api.sursatech.com/api/a2a answers the 1.0 method names SendMessage and GetTask with 401 + WWW-Authenticate (routed, bearer-gated); the 0.3-era names message/send and tasks/get return JSON-RPC -32601 Method not found. Partial because only the auth gate was observed — no authenticated call was made, so task lifecycle, streaming (capabilities.streaming: true) and the extended card are unverified.'
- id: json-rpc-2.0
  conforms: true
  evidence: 'Endpoint speaks JSON-RPC 2.0 over HTTP POST: {"jsonrpc":"2.0","id":1,"error":{"code":-32601,"message":"Method not found"}} for unknown methods; GET returns 405.'
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: https://api.sursatech.com/.well-known/oauth-authorization-server 200 with issuer, token_endpoint, jwks_uri, registration_endpoint, grant_types_supported, scopes_supported, token_endpoint_auth_methods_supported, response_types_supported, service_documentation (well-known/sursatech-com-oauth-authorization-server.json); also served on www. Non-standard additions — authorization_endpoint is a markdown document and an agent_auth extension block.
- id: oidc-discovery
  conforms: true
  partial: true
  evidence: 'https://api.sursatech.com/.well-known/openid-configuration 200 with issuer, jwks_uri, subject_types_supported [public] — but response_types_supported ["none"], id_token_signing_alg_values_supported [] and claims_supported []: the document is served, and it describes a provider that issues no ID tokens. Discovery present; OpenID Connect authentication not offered.'
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: 'https://api.sursatech.com/.well-known/oauth-protected-resource 200 — resource https://api.sursatech.com/api/a2a, authorization_servers [https://api.sursatech.com], scopes_supported, bearer_methods_supported [header], resource_documentation; AND the resource server''s 401 carries WWW-Authenticate: Bearer realm="SursaTech A2A", resource_metadata="<that URL>" (RFC 9728 §5.1). A second document on www.sursatech.com declares the website origin as a resource.'
- id: rfc7591-dynamic-client-registration
  conforms: true
  partial: true
  evidence: 'registration_endpoint https://api.sursatech.com/api/a2a/register accepts an anonymous POST and issues credentials (observed 200 on an empty body). Partial: the response uses camelCase fields (clientId, accessToken, tokenType, rateLimitPerMinute) rather than RFC 7591 §3.2.1 client_id / registration_access_token, and returns a bearer access token directly instead of client credentials to exchange.'
- id: rfc6749-client-credentials
  conforms: true
  partial: true
  evidence: 'token_endpoint https://api.sursatech.com/api/a2a/token; grant_types_supported [client_credentials]; the observed token response uses the RFC 6749 §5.1 names (access_token, token_type, scope) and client_id. Partial: token_endpoint_auth_methods_supported ["none"] and an empty anonymous body is accepted, so no client is actually authenticated.'
- id: rfc7517-jwks
  conforms: true
  partial: true
  evidence: 'jwks_uri https://api.sursatech.com/.well-known/jwks.json serves {"keys":[]} — a valid but empty JWK Set. Tokens are opaque (bearerFormat "opaque"), so the empty set is consistent rather than broken.'
- id: rfc9727-api-catalog
  conforms: true
  partial: true
  evidence: 'https://www.sursatech.com/.well-known/api-catalog 200 — a linkset with one anchor (the A2A endpoint), service-desc, service-doc, status and the a2a-protocol.org agent-card relation. Partial: served as application/json rather than application/linkset+json, absent on the api host, and the service-desc target https://api.sursatech.com/openapi.json returns 404 — the catalog advertises a contract that is not served.'
- id: agentskills-io-index
  conforms: true
  partial: true
  evidence: 'https://www.sursatech.com/.well-known/agent-skills/index.json 200, $schema https://agentskills.io/schemas/index/v0.2.0.json, four skills (knowledge x3, tool x1). Partial: every skill url points at the A2A endpoint rather than a skill document, and every sha256 is the literal "pending" — an index with no skill bodies behind it (skills/_index.yml).'
- id: llms-txt
  conforms: true
  evidence: https://www.sursatech.com/llms.txt 200 text/markdown — H1, blockquote summary, "Pages" and "For AI agents" sections in llms.txt format; listed in the sitemap. Saved verbatim at llms/sursatech-com-llms.txt. No llms-full.txt (404).
- id: rfc9309-robots
  conforms: true
  evidence: 'https://www.sursatech.com/robots.txt cites RFC 9309, Disallows /admin, /login and /api/ for every agent, explicitly Allows / for GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-Web, Google-Extended, PerplexityBot and CCBot, and names the sitemap.'
- id: content-signals
  conforms: true
  evidence: 'robots.txt carries "Content-Signal: ai-train=yes, search=yes, ai-input=yes" per https://contentsignals.org/ — an explicit, permissive AI-use declaration for the public marketing content.'
- id: openapi
  conforms: false
  evidence: 'No OpenAPI/Swagger is served on any host: api.sursatech.com /openapi.json (the URL the api-catalog advertises), /openapi.yaml, /swagger.json, /v1/openapi.json, /api/openapi.json, /api-docs, /docs, /redoc all 404; www.sursatech.com equivalents return the Next.js not-found page. The A2A card is the only machine-readable contract.'
- id: mcp-streamable-http
  conforms: false
  evidence: 'No MCP server is advertised. POST https://api.sursatech.com/api/mcp answers 401 {"detail":"Missing bearer token"} with the RFC 9728 challenge (GET 405) — a bearer-gated route exists at that path but tools/list and initialize could not be observed without credentials, so MCP is recorded as unverified, not present (mcp/sursatech-com-mcp.yml).'
- id: graphql
  conforms: false
  evidence: /graphql and /api/graphql 404 on api.sursatech.com; 404 page on www.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt and /security.txt 404 on www.sursatech.com and api.sursatech.com (probe 2026-09-19).
- id: rfc9457-problem-details
  conforms: false
  evidence: 'Errors are FastAPI {"detail": "…"} objects (401/404/405) or JSON-RPC 2.0 error objects, served as application/json; no application/problem+json anywhere (errors/sursatech-com-problem-types.yml).'
- id: idempotency-key
  conforms: false
  evidence: No idempotency header, key or replay guarantee is documented in auth.md, the card or the discovery metadata; the write skills describe verification gates, not idempotency (conventions/sursatech-com-conventions.yml idempotency.coverage none).
- id: rfc8594-sunset-deprecation-headers
  conforms: false
  evidence: No versioning or deprecation policy is published and no Sunset/Deprecation header was observed on any response.
- id: rate-limit-headers
  conforms: false
  evidence: 'Limits exist (auth.md: rate-limited per client and per IP; registration returns rateLimitPerMinute 60) but no RateLimit-*/X-RateLimit-*/Retry-After header was observed on the unauthenticated responses, and none is documented (rate-limits/sursatech-com-rate-limits.yml).'
- id: hsts
  conforms: true
  evidence: 'api.sursatech.com: strict-transport-security: max-age=31536000; includeSubDomains (observed); sursatech.com HSTS max-age 63072000, TLSv1.3, DNSSEC signed (security/sursatech-com-domain-security.yml).'
- id: schema-org-organization
  conforms: true
  evidence: 'Every page embeds a schema.org ProfessionalService JSON-LD (@id https://www.sursatech.com/#organization) with legalName "Sursa Technology Private Limited", foundingDate 2017, PostalAddress (Kathmandu, NP), email and sameAs (LinkedIn, GitHub).'
domain_standard_note: 'REWARD-ONLY check, deliberately left empty: SursaTech''s market (AI consulting / product engineering services) has no domain interchange standard, and the agent surface declares none (no SCIM URN, OData, OpenRTB, LTI, HL7, ISO 20022 or similar in the card or metadata). Nothing is invented to fill the slot.'
compliance_programs_published: false
compliance_note: No trust center, certifications (SOC 2 / ISO 27001 / etc.), privacy policy or terms page is published on www.sursatech.com (/privacy, /terms, /security, /trust all 404; probe-security-programs.py vdp=none trust=none), so no Compliance pointer is emitted.