generated: '2026-09-04'
method: probed
source: https://docs.xcures.com/.well-known/agent-card.json
name: xCures API Hub
discovery:
  path: /.well-known/agent-card.json
  canonical: true
  host: docs.xcures.com
x-evidence:
  fetched: '2026-09-04'
  url: https://docs.xcures.com/.well-known/agent-card.json
  http_status: 200
  content_type: application/json
  bytes: 3660
card:
  file: xcures-agent-card.json
  name: xCures API Hub
  url: https://docs.xcures.com/a2a
  documentationUrl: https://docs.xcures.com/
  version: 0.0.1
  protocolVersion: 0.3.0
  preferredTransport: HTTP+JSON
  capabilities:
    streaming: false
    pushNotifications: false
    extensions:
    - uri: https://modelcontextprotocol.io
      description: Model Context Protocol server exposing the documentation tools and skills.
      params_url: https://docs.xcures.com/mcp
      authentication_required: true
      authentication_schemes:
      - bearer
      - oauth2
  defaultInputModes:
  - text/plain
  defaultOutputModes:
  - text/plain
  skill_count: 6
  skills:
  - bulk-patient-onboarding
  - byod-ingestion
  - reciprocity
  - requery-patient
  - retrieval-only
  - standard-treatment-workflow
grade_basis: 'Graded against A2A 1.0.0 hard checks: capabilities is an OBJECT (pass), protocolVersion is present (pass), skills is an ARRAY (pass). No hard failure. The optional fields that separate conformant from near-conformant are all present: preferredTransport (HTTP+JSON), defaultInputModes and defaultOutputModes.'
deviations:
- field: protocolVersion
  detail: Declares 0.3.0, not 1.0.0. The card was authored against the pre-1.0 A2A protocol; the well-known path is nonetheless the current canonical /.well-known/agent-card.json rather than the legacy /.well-known/agent.json.
- field: skills[].url
  detail: Each skill carries a non-standard `url` pointing at its published SKILL.md under /.well-known/agent-skills/. Not an A2A AgentSkill field, but it is a useful and honest extension — the six documents it names are all served and were fetched (see skills/).
- field: provider
  detail: The optional provider object (organization + url) is absent.
- field: securitySchemes / security
  detail: Absent from the card. The MCP extension it advertises does declare its auth (bearer/oauth2) inline, and the endpoint answers an anonymous call with an RFC 9728 WWW-Authenticate challenge.
- field: version
  detail: Card version is 0.0.1, suggesting a first publication rather than a matured surface.
note: The card is served from xCures' own docs host and its whole skill list is xCures' own published workflow documentation, so it is unambiguously a first-party publication. It is generated by the Redocly Realm platform that hosts the API Hub — hence the name "xCures API Hub" and the docs-scoped MCP extension — rather than describing an agent that operates the xCures Public API itself.
conformance:
  grade: conformant