Discovery and Auth-Posture Probe — AI Crawler Index

Name a host and it GETs the documents an agent client reads BEFORE it dials anything, then says what each one answered and what a client does with that answer: /.well-known/oauth-protected-resource in BOTH forms — the root form everyone publishes and the RFC 9728 §3.1 insertion form a spec-following client actually requests for a resource served under a path — /.well-known/oauth-authorization-server, /.well-known/mcp, /.well-known/mcp.json, /mcp.json and /llms.txt. Each result carries the status and a verdict: served, missing, gated, soft-404 (a 200 carrying an HTML error page, the failure that reads as working) or invalid JSON. GET only. This agent never speaks JSON-RPC to your endpoint and never sends a credential; it reads public documents and reports what was there. A missing document is reported as missing, never as a vulnerability. Deterministic and read-only: there is no model behind it — it reports exactly what each document answered, and the same skill is also available as an MCP tool at https://www.pathwren.workers.dev/mcp/lint. No key, no signup, no quota. Independent and unaffiliated with any operator it documents. TO CALL IT: send `message/send` (v1.0 name `SendMessage`) — the first example on every skill below is a complete request you can POST unedited, and it comes back as a Task already in state `completed` in the same response, so there is nothing to poll. Nothing to hand over? The `whoami` skill takes no arguments and answers about you. Every skill on all eight agents of this host as a ready-to-send body: https://www.pathwren.workers.dev/a2a/example.json