OAuth/OIDC discovery metadata exists

agent_protocol_oauth_discovery

Checks if OAuth/OIDC discovery metadata is published for agent authentication.

What does this rule check?

OAuth/OIDC discovery endpoints allow AI agents to programmatically discover how to authenticate with your protected APIs. The metadata includes the authorization endpoint, token endpoint, supported grant types, and JWKS URI.

Why is this important?

Without OAuth discovery, agents cannot automatically authenticate with your APIs. They require manual configuration for each integration, which doesn't scale for AI agent ecosystems.

How to fix

Publish /.well-known/openid-configuration (for OIDC) or /.well-known/oauth-authorization-server (for OAuth 2.0) with your authentication metadata.

Examples

GET /.well-known/openid-configuration
HTTP/1.1 404 Not Found

GET /.well-known/oauth-authorization-server
HTTP/1.1 404 Not Found

GET /.well-known/openid-configuration

HTTP/1.1 200 OK
Content-Type: application/json

{"issuer": "https://example.com", "authorization_endpoint": "https://example.com/oauth/authorize", "token_endpoint": "https://example.com/oauth/token"}

Agent fix snippet

Copy this snippet and paste it into your AI coding agent to fix this issue automatically.

Publish /.well-known/openid-configuration:

{
  "issuer": "https://yourdomain.com",
  "authorization_endpoint": "/oauth/authorize",
  "token_endpoint": "/oauth/token",
  "jwks_uri": "/.well-known/jwks.json",
  "grant_types_supported": ["authorization_code", "client_credentials"]
}