API, Auth, MCP & Skill Discovery

API Catalog

An API catalog lists your APIs and points at each one's description, documentation and status endpoint, using the RFC 9727 linkset format.

Why it matters

It is how an agent that has never seen your product finds out you have an API at all, without reading your marketing site.

Pass criteria

/.well-known/api-catalog returns application/linkset+json with at least one entry.

What the scanner records
Every request the check makes is recorded (URL, method, response status, relevant headers and a body preview) and shown under the check in your results.

How to implement it

Publish an API catalog for automated API discovery (RFC 9727)

/.well-known/api-catalog returns application/linkset+json with at least one entry.

The step-by-step implementation prompt is part of the Pro plan.

See plans

www.rfc-editor.org SKILL.md

Scan your site

See whether this check passes on your domain, along with the other 21.

Run a scan

Related checks

OAuth discovery

/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.

OAuth Protected Resource

/.well-known/oauth-protected-resource declares resource and authorization_servers.

Auth.md

/auth.md exists with a markdown H1 mentioning auth.md.

MCP Server Card

/.well-known/mcp/server-card.json describes the server with a serverInfo.name.

A2A Agent Card

/.well-known/agent-card.json declares name, version and supported interfaces.

Agent Skills

/.well-known/agent-skills/index.json lists at least one skill.

WebMCP

Page code registers browser-side tools through navigator.modelContext.

ARD manifest

/.well-known/ai-catalog.json declares specVersion, host and at least one entry.