Machine-readable discovery fileRead stepEffort: minutes, our estimate
FailIf it's missing on your site
A file at a standard address (/.well-known/...) that says how your API or sign-in works.
PassFrom Gumloop, on our 9 Nov 2026 scan
mcp.gumloop.com/.well-known/oauth-protected-resource
{ "resource": "https://mcp.gumloop.com", "authorization_servers": ["https://api.gumloop.com"], "scopes_supported": ["gumstack"], "bearer_methods_supported": ["header"]}Then one prompt for your coding agent, or the fix opened in Cursor, GitHub or Linear.