Fix: OAuth/OIDC discovery metadata published
Web-audit fix skill for the
oauth-discoverycheck (Agent discovery & auth, MAY).
Goal
Publish OAuth/OIDC discovery metadata if agents authenticate to your service.
Fix
If agents authenticate to your service, publish OAuth/OIDC discovery metadata at /.well-known/openid-configuration or /.well-known/oauth-authorization-server (RFC 8414 / OIDC Discovery). Absent metadata is expected for an open server; present metadata is required for an authenticated one.
Resources
Copy-paste prompt
Paste this into your coding agent, replacing the Issue line with the Result line from your audit:
Verify
Re-run the audit at https://anc.dev/web-audit or call the audit_website MCP tool; the oauth-discovery check should report pass.