api.qa/api.qa · Grade A+

#	Check	Verdict
01	llms.txt is served and agent-actionable	PASS
02	/.well-known/agents.json capability card parses	PASS
03	/icp.json self-classification surface	PASS
04	root content-negotiates (curl → markdown, browser → HTML, agent JSON → JSON/non-HTML)	PASS
05	machine-readable API contract (OpenAPI) is published	PASS
06	MCP interface declared with transport + tools	PASS
07	at least one declared endpoint answers 2xx with no key	PASS
08	payment boundaries answer as structured 402 offers	PASS
09	surfaces cross-reference each other (linkset)	PASS
10	attestation/identity ladder is declared	PASS

PASSllms.txt is served and agent-actionablellms-txt

markdown with an H1 and substantive content

PASS/.well-known/agents.json capability card parsesagents-json

valid JSON; name="api.qa", 4 http endpoint(s) declared

PASS/icp.json self-classification surfaceicp-json

valid JSON with agent_classes — an agent can self-classify

PASSroot content-negotiates (curl → markdown, browser → HTML, agent JSON → JSON/non-HTML)content-negotiation

Accept: */* got non-HTML text; Accept: text/html got HTML; Accept: application/json served no JSON body but did NOT return HTML (agent-actionable non-HTML fallback — partial credit)

PASSmachine-readable API contract (OpenAPI) is publishedopenapi

OpenAPI parses; 4 path(s), 2 keyless GET candidate(s)

PASSMCP interface declared with transport + toolsmcp-declared

mcp: stdio with tools [verify_domain, discover_domain, verify_pinned_spec] (presence-grade; stdio not spawned)

skipMCP endpoint publishes RFC 9728 protected-resource metadatamcp-oauth-protected-resource

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipauthorization server publishes RFC 8414 metadata (openid-configuration fallback)mcp-oauth-as-metadata

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipauthorization server advertises PKCE S256 (RFC 7636)mcp-pkce

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipauthorization server supports Dynamic Client Registration (RFC 7591)mcp-oauth-dcr

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipprotected-resource declares an RFC 8707 audience bound to the MCP originmcp-oauth-resource-indicators

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipunauthenticated MCP request returns 401 with WWW-Authenticate → protected-resource metadatamcp-www-authenticate

MCP declared stdio transport (no url) — not an OAuth resource server; skipped

skipAAP discovery advertises Ed25519 + approval methods + register/status/revoke + jwks_uriaap-discovery

no /.well-known/agent-configuration document (2xx) — target does not claim the Agent Auth Protocol

skipauth.md agent-identity advertised (agent_auth identity/claim/events + ID-JAG + SET revocation)authmd-agent-identity

no authorization-server metadata resolved (no MCP/OAuth AS declared) — nothing advertises an agent_auth block

PASSat least one declared endpoint answers 2xx with no keykeyless-flow

3/3 sampled endpoint(s) answered 2xx keyless (seed 1750173690)

PASSpayment boundaries answer as structured 402 offersoffers-402

declared boundary answered HTTP 402 with a typed OFFER (type:"OFFER" + id/title + price|checkoutUrl|alternatives)

PASSsurfaces cross-reference each other (linkset)linkset

Link header present on root

PASSattestation/identity ladder is declaredattestation

attestation ladder declared (agents.json attestationLadder / icp.json ladder)

PASSsampled responses conform to their published schemasschema-conformance

2 sampled response(s) conform to their OpenAPI schemas

PASSclaimed endpoints actually exist (no ghost surface)claims-honesty

every probed claimed endpoint exists (no 404/5xx)

PASSlive responses match the published OpenAPI contract (full diff)contract-diff

live surface conforms to every declared contract; 5 additive deviation(s) (undeclared field/endpoint — live has more than declared, non-breaking)

skipMCP registry manifest (server.json) is valid and registry-publishablemcp-server-json

no server.json manifest served at the well-known/declared path — target is not claiming MCP-registry publishability

skipdeclared MCP remote resolves live (initialize → tools/list advertises tools)mcp-remote-live

no server.json manifest — no registry remote to resolve

skipdomain/account can prove ownership to publish under its reverse-DNS namespacemcp-registry-ownership

no server.json manifest — no namespace ownership to prove

skipserver is present in the official MCP registry (informational)mcp-registry-presence

no server.json manifest — registry presence not applicable

skipMCP-UI tool result links a ui:// resource served with an MCP-Apps MIMEmcp-ui-resource-linkage

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipui:// srcDoc is self-contained (no remote code) and CSP-safemcp-ui-self-contained

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipno secret leaks into a model-visible channel (content/structuredContent)mcp-ui-envelope-hygiene

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipwidget structuredContent is consistent with the agent/API register (no divergence)mcp-ui-register-parity

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipfirst-render-without-input tolerance + tool annotations / widgetDescription presentmcp-ui-host-render

no MCP-UI declared (no tool advertises a ui:// template) — informational not-ready, not a failure

skipUI-message-stream is served with the v1 stream header and an SSE content-typeui-stream-transport

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skipSSE framing is valid — data:{json} chunks, a bare [DONE] terminal, each payload a typed JSON partui-stream-framing

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skipevery UI-message-stream part is spec-correct (known type, required fields present)ui-stream-part-shapes

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skipno secret leaks into any UI-message-stream part (token/key in a part → FAIL)ui-stream-envelope-hygiene

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skiptool-output-available `output` is byte/JSON-consistent with the JSON twin (no divergence)ui-stream-parity

no UI-message-stream face declared (no interfaces.uiMessageStream) — informational not-ready, not a failure

skipa DECLARED Digital Link interface serves a schema-valid GS1 resolver description file at its well-knowndigital-link-resolver

no Digital Link interface declared (agents.json `interfaces.digitalLink` absent) — the interface is OPTIONAL and this card does not claim it, so nothing was fetched and nothing is judged; under a pinned must:pass this fails closed

skipa DECLARED test-suite interface publishes a digest-pinned suite the surface actually passespublished-test-suite

no published test suite interface declared (agents.json `interfaces.testSuite` absent) — the interface is OPTIONAL and this card does not claim it, so nothing was fetched and nothing is judged; under a pinned must:pass this fails closed

skipevery capability the card declares is exercised by a passing test of its published suitecapability-coverage

no published test suite interface declared (agents.json `interfaces.testSuite` absent) — capability coverage is judged only over a declared suite's run (A.8.7): nothing is claimed, so nothing is judged; under a pinned must:pass this fails closed

skiphome + typed bodies are machine-legible for every machine-class client (AXP Clause 3)machine-legible-home