G05 · Agent capability matrix
OAuth protected-resource (RFC 9728)
/.well-known/oauth-protected-resource with a resource field
Why it is checked
Checks for OAuth protected-resource metadata (RFC 9728) — how your site tells agents which authority protects its API.
How it counts
Never scored. Agent capabilities are optional: "not found" is neutral and does not affect your base score.
How results read
The wording below is exactly what a report shows for each result.
- Passed
In this check, the probe met this item's verification conditions — the capability is published with a valid declaration on the pages we checked. No action needed.
- Declared · incomplete
In this check, we found a declaration for this capability, but it is incomplete or not fully verifiable. See the suggested steps to complete it.
- Not found · optional
Within this check's probe range, we did not find this capability published. It is an optional capability: adding it depends on your site's purpose and it never affects your base score. Optional capability — whether to add it depends on your site's purpose; it does not affect your base score.
- Couldn't verify
We could not verify this item in this check (access was blocked, the network failed, or this protocol has no statically checkable marker). No conclusion is drawn either way.
How to fix it
Fix steps depend on what the check actually finds on your site, so they appear in your report next to this item, together with the evidence. Rule templates only — no AI model writes them.