{
  "site": "mcp.trulioo.com",
  "operator": "Trulioo",
  "description": "Entry point for what mcp.trulioo.com publishes to an agent client. This host runs an MCP server; the endpoint is OAuth-protected and an unauthenticated request is refused, so the documents that let a client get a token are listed below and the walk starts at the challenge the endpoint returns. This is an index of documents, not an inventory of every route, and it restates no claim about any agent: the agents Trulioo has verified, their identifiers and the issuer's posture are published at the agent index below and resolvable at the issuer named there, because a mirror of a claim is a second copy that goes stale. No `issuer` is named at this level on purpose - the authorization server for the endpoint below identifies itself in its own metadata, and a second issuer field here would be two different things under one name.",
  "agent_index": "https://agents.trulioo.com/.well-known/agents.json",
  "documents": [
    {
      "path": "/mcp",
      "type": "mcp-endpoint",
      "description": "The MCP endpoint, Streamable HTTP. OAuth 2.1 authorization_code with PKCE; an unauthenticated request is refused with 401 and a WWW-Authenticate challenge naming the protected-resource metadata below, which is where a client should start rather than here"
    },
    {
      "path": "/.well-known/oauth-protected-resource/mcp",
      "type": "oauth-protected-resource-metadata",
      "description": "RFC 9728 metadata for the endpoint above: the resource identifier and the authorization servers a client may use. The first hop of the discovery chain, and the document the challenge points at"
    },
    {
      "path": "/.well-known/oauth-authorization-server",
      "type": "oauth-authorization-server-metadata",
      "description": "RFC 8414 metadata for the authorization server named above: its issuer, authorization, token and registration endpoints, the key set, and the PKCE methods it supports"
    },
    {
      "path": "/.well-known/openid-configuration",
      "type": "oauth-authorization-server-metadata",
      "description": "The same document at the OpenID Connect discovery location, byte-identical, for clients that look there first. Not a second authorization server"
    },
    {
      "path": "/.well-known/jwks.json",
      "type": "json-web-key-set",
      "description": "The key set the authorization server above advertises, for verifying the access tokens it issues"
    },
    {
      "path": "/auth/jwks",
      "type": "json-web-key-set",
      "description": "The session key set: the keys a relying party fetches to verify this host's own session tokens. A different key set from the authorization server's, at a different path, on purpose"
    },
    {
      "path": "/.well-known/skills",
      "type": "skill-index",
      "description": "The skills this host publishes, one per family of tools. This path answers 301 to the index document beneath it, so follow the redirect; each skill it names is Markdown, and the bodies are served without a Markdown content-type today, so read them as text rather than trusting the type"
    },
    {
      "path": "/.well-known/ai-catalog.json",
      "type": "catalog",
      "description": "This document - the domain-level entry point for what this host publishes"
    },
    {
      "path": "/llms.txt",
      "type": "summary",
      "description": "Plain-text orientation for a model reading this host, and the pointer to the Markdown twin of every documentation page"
    },
    {
      "path": "/llms-full.txt",
      "type": "summary",
      "description": "The long form of the above: the documentation flattened into one plain-text document"
    },
    {
      "path": "/index.md",
      "type": "markdown-page",
      "description": "The Markdown twin of the landing page, so a model reads the content rather than scraping the HTML"
    },
    {
      "path": "/agent-guide.md",
      "type": "integration-guide",
      "description": "How to connect an agent to this MCP server: transport, authorization, and the tool families it exposes"
    },
    {
      "path": "/developer/",
      "type": "developer-docs",
      "description": "Human-readable developer documentation for the Trulioo APIs this server calls"
    },
    {
      "path": "/robots.txt",
      "type": "crawl-policy",
      "description": "The crawl policy for this host: a blanket disallow, a named exception for each document that is in crawl scope, and a pointer to the sitemap. Fewer paths than this catalog lists - the OAuth chain and the key sets above are documented here and deliberately left out of crawl scope, each for a reason written into that file"
    },
    {
      "path": "/sitemap.xml",
      "type": "sitemap",
      "description": "The crawl-scope subset of this catalog, for a crawler. Not every document above"
    }
  ]
}