Discovery and RFC Map

Discovery and RFC Map

This page maps public discovery endpoints to the standards and client behaviors they support.

Core Endpoints

Endpoint	Purpose
https://mcp.arleo.eu/mcp	MCP Streamable HTTP JSON-RPC endpoint
https://mcp.arleo.eu/.well-known/oauth-authorization-server	OAuth Authorization Server Metadata
https://mcp.arleo.eu/.well-known/oauth-protected-resource	OAuth Protected Resource Metadata
https://mcp.arleo.eu/.well-known/oauth-protected-resource/mcp	Protected resource alias for /mcp clients
https://mcp.arleo.eu/.well-known/mcp/server-card.json	MCP server card
https://mcp.arleo.eu/.well-known/mcp.json	Compatibility alias for server card
https://www.arleo.eu/auth.md	Public agent auth guide consumed by AgentReady scanners
https://mcp.arleo.eu/auth.md	MCP-hosted auth guide
https://www.arleo.eu/llms.txt	LLM discovery
https://www.arleo.eu/robots.txt	Crawler access policy

OAuth Metadata Invariants

Authorization server metadata should expose:

issuer
authorization_endpoint
token_endpoint
registration_endpoint
scopes_supported
response_types_supported
grant_types_supported
code_challenge_methods_supported
token_endpoint_auth_methods_supported

Protected resource metadata should expose:

resource
authorization_servers
bearer_methods_supported
scopes_supported

Expected values:

issuer = https://mcp.arleo.eu
resource = https://mcp.arleo.eu/mcp
authorization_servers includes https://mcp.arleo.eu

AgentReady Auth.md Invariants

auth.md must contain human-readable guidance and machine-readable registration metadata.

Required machine-readable concepts:

• registration_endpoint
• authorization_endpoint
• token_endpoint
• MCP endpoint
• canonical scopes
• agent registration flow
• agent_auth_metadata
• identity_assertion
• ID-JAG token type
• credential_types_supported

Standards Checklist

Area	Expected support
OAuth 2.0	Authorization Code
PKCE	S256
Bearer tokens	Authorization: Bearer header
OAuth metadata	RFC 8414 style authorization server metadata
Protected resource metadata	RFC 9728 style metadata
Dynamic Client Registration	/register, bounded by policy
MCP	Streamable HTTP transport at /mcp
Server card	canonical /.well-known/mcp/server-card.json plus compatibility alias

Quick Verification

curl -sk https://mcp.arleo.eu/.well-known/oauth-authorization-server | jq .
curl -sk https://mcp.arleo.eu/.well-known/oauth-protected-resource | jq .
curl -sk https://mcp.arleo.eu/.well-known/oauth-protected-resource/mcp | jq .
curl -sk https://mcp.arleo.eu/.well-known/mcp/server-card.json | jq .
curl -sk https://www.arleo.eu/auth.md | grep -E 'registration_endpoint|agent_auth_metadata|credential_types_supported'

If any required endpoint returns 404, first check the host routing and reverse proxy before changing protocol code.