Skip to main content

Component: Capability Discovery

What it is: a resolver for declared tools, implementing RFC 9728 (OAuth 2.0 Protected Resource Metadata).

What it does: given the set of authorities (hosts) a manifest's declared tools live on, fetches each one's /.well-known/oauth-protected-resource and returns what it actually advertises — the ground truth the Reconciler checks a declaration against.

Why a per-authority result, not one pass/fail: one unreachable tool must not block reconciliation of every other declared tool. A manifest naming three tools where one authority is down still gets a precise diff — DISCOVERY_UNAVAILABLE for that one authority — rather than a single opaque failure covering all three.