{
  "reportVersion": "1.2",
  "title": "GuGuData MCP and Agent Skills Compatibility Report",
  "testedAt": "2026-08-17T01:01:02+08:00",
  "summary": {
    "status": "PASS_WITH_DECLARED_BOUNDARY",
    "statement": "Production discovery, exact authentication challenges, OAuth metadata and entry points, and all four published Skill artifacts passed. The release gate also covers all 52 API Markdown routes plus exact OAuth callback and token rotation behavior. Real production account invocation and third-party MCP Host interoperability were intentionally not performed."
  },
  "environment": {
    "productionMcpEndpoint": "https://mcp.gugudata.io/mcp",
    "productionSkillIndex": "https://gugudata.io/.well-known/agent-skills/index.json",
    "mcpServerVersion": "0.2.0",
    "mcpPythonSdk": "2.0.0",
    "testedClients": [
      "MCP Python SDK 2.0.0",
      "MCP Python SDK 1.8.0 compatibility probe",
      "httpx 0.28.1",
      "Node.js fetch",
      "Python urllib",
      "curl 8.7.1"
    ]
  },
  "matrix": [
    {
      "area": "MCP 2026-07-28",
      "scenario": "server/discover and stateless negotiation",
      "scope": "Production OAuth challenge plus isolated authorized end-to-end",
      "result": "PASS",
      "evidence": "Production returned 401 with RFC 9728 resource metadata and no Mcp-Session-Id. The isolated authorized client negotiated 2026-07-28 and rediscovered tools after reconnect."
    },
    {
      "area": "Initialize-based MCP",
      "scenario": "2025-11-25 and earlier initialization handshake",
      "scope": "Production OAuth challenge plus isolated authorized end-to-end",
      "result": "PASS",
      "evidence": "Production returned the same OAuth challenge for initialize traffic. SDK 2.0 legacy mode and the isolated SDK 1.8.0 probe completed discovery and reconnect checks."
    },
    {
      "area": "OAuth discovery",
      "scenario": "Protected resource and authorization server metadata",
      "scope": "Production",
      "result": "PASS",
      "evidence": "The protected resource is bound to https://mcp.gugudata.io/mcp. Authorization, token, registration, revocation, PKCE S256, CIMD, and authorization response issuer metadata were present."
    },
    {
      "area": "OAuth client entry",
      "scenario": "Dynamic client registration and authorization redirect",
      "scope": "Production, no account credentials submitted",
      "result": "PASS",
      "evidence": "A public client registered without a client secret and the authorization request redirected to the GuGuData login step with no-store caching."
    },
    {
      "area": "Transport fingerprints",
      "scenario": "OAuth challenge through Node.js fetch, Python urllib, and curl",
      "scope": "Production",
      "result": "PASS",
      "evidence": "All tested HTTP clients received the exact Bearer resource metadata challenge with mcp:access scope and no Mcp-Session-Id. The earlier generic urllib edge rejection was not reproduced."
    },
    {
      "area": "OAuth lifecycle",
      "scenario": "PKCE code, token, refresh, resource binding, and revocation",
      "scope": "Isolated end-to-end",
      "result": "PASS",
      "evidence": "The self-test covered approval and denial responses, exact issuer, token rotation, resource binding, and revocation without using production credentials."
    },
    {
      "area": "OAuth callback and tokens",
      "scenario": "Exact callback URI, PKCE code exchange, access and refresh token issuance, and one-time refresh rotation",
      "scope": "Unit and isolated end-to-end",
      "result": "PASS",
      "evidence": "The registered cursor://oauth-callback URI was preserved exactly through authorization, the callback carried code, state, and issuer, token responses contained the configured lifetime, and refresh rotation invalidated both prior tokens."
    },
    {
      "area": "API LLM Markdown routes",
      "scenario": "Every published API identity returns its own raw Markdown document",
      "scope": "Release build and post-deployment production gate",
      "result": "PASS",
      "evidence": "All 52 API identities are generated from the shared SSR Markdown builder and must return HTTP 200, text/markdown, a Markdown heading, and identity-specific demo and raw-document links; HTML fallback fails the release gate."
    },
    {
      "area": "Entitlements",
      "scenario": "Account-scoped tools and non-purchased tool rejection",
      "scope": "Isolated end-to-end",
      "result": "PASS",
      "evidence": "Normal and VIP fixtures exposed only the expected tool set, kept execution keys server-side, and rejected tools outside the entitlement snapshot."
    },
    {
      "area": "Production account invocation",
      "scenario": "Authorized tool discovery and call with a real account",
      "scope": "Production",
      "result": "NOT_RUN",
      "evidence": "No production credentials or paid API calls were used. This boundary is explicit and is not represented as a protocol failure."
    },
    {
      "area": "Third-party MCP Host interoperability",
      "scenario": "Authorized discovery and tool calls from external MCP Hosts",
      "scope": "Production",
      "result": "NOT_RUN",
      "evidence": "No real Cursor, Claude, ChatGPT, or other third-party Host was authorized during this refresh. Protocol SDK probes do not replace Host-specific interoperability testing."
    }
  ],
  "skills": [
    {
      "name": "use-gugudata-api",
      "result": "PASS",
      "httpStatus": 200,
      "contentType": "text/markdown",
      "digest": "sha256:49e8c704e0451e571c2a90ca341455f90ef2abd5e63b5ba3479298e6507e3265",
      "landingPath": "/skills/use-gugudata-api"
    },
    {
      "name": "review-website-quality",
      "result": "PASS",
      "httpStatus": 200,
      "contentType": "text/markdown",
      "digest": "sha256:117367e085068d36386681c230e6ce28bfed12a36bd01e38b460f4837474cc27",
      "landingPath": "/skills/review-website-quality"
    },
    {
      "name": "review-document-ocr",
      "result": "PASS",
      "httpStatus": 200,
      "contentType": "text/markdown",
      "digest": "sha256:939d78e274c5c42d3afc93498555c322a209f33c30c2d2d0754412b3a77a8d16",
      "landingPath": "/skills/review-document-ocr"
    },
    {
      "name": "review-stock-symbol-integration",
      "result": "PASS",
      "httpStatus": 200,
      "contentType": "text/markdown",
      "digest": "sha256:9d922fd95ba3359bd894c3cc80f79f2794ec9efaa8ec08b7b62cdf9003bf2fb9",
      "landingPath": "/skills/review-stock-symbol-integration"
    }
  ],
  "attribution": {
    "funnel": [
      "view_skill",
      "begin_skill_trial",
      "view_skill_trial",
      "generate_trial_key"
    ],
    "source": "agent_skill",
    "medium": "owned_skill_landing",
    "campaign": "agent_skill_trial",
    "queryParameters": [
      "skill_source",
      "skill_medium",
      "skill_campaign",
      "skill_name"
    ],
    "skillDimension": "skill_name",
    "baselineRule": "Measure unique users and event conversion by skill from this report date. Pre-launch historical attribution is unavailable and must remain zero or unknown, not backfilled."
  },
  "advisories": [
    "Node.js fetch, Python urllib, and curl received the expected production OAuth challenge during this refresh. Untested custom HTTP fingerprints remain outside this point-in-time result.",
    "Skill artifact checks validate public availability, Markdown content type, discovery membership, and SHA-256 integrity. They do not consume paid API credits.",
    "Dynamic client registration creates a persistent public client record, so the live DCR check is opt-in rather than part of every routine run.",
    "This report is a point-in-time compatibility result. Re-run the matrix after protocol, OAuth, edge policy, or Skill artifact changes."
  ]
}