{"rule_id":"AB-063","category":"bot_auth","icon":"🛡️","title":"Protected Resource Metadata","short_description":"Your site publishes metadata about what resources are protected and how.","user_value":"This metadata tells agents which endpoints need authentication and what type, so they know before making requests.","wrong_example":"No protected resource metadata. Agents don't know which endpoints need auth.","right_example":"Protected resource metadata clearly indicates which endpoints need auth and how.","effort_hint":"moderate","estimated_cost":"$10-50","severity":"medium","pillar":"executability","version":"1.0.0","counted_in_score":true,"check":{"type":"http_fetch","sources":["oauth_protected_resource"],"target":"/.well-known/oauth-protected-resource"},"fix":{"eligible":true,"type":"assisted","note":"Publish /.well-known/oauth-protected-resource with resource, authorization_servers, scopes_supported, bearer_methods_supported"},"checklist_anchor":"#AB-063","checklist_url":"/agent-readiness-checklist#AB-063","html_url":"/rules/AB-063","json_url":"/rules/AB-063.json","related_rules":[{"rule_id":"AB-023","title":"MCP Auth Discovery","category":"bot_auth"},{"rule_id":"AB-058","title":"Bot Signatures Directory","category":"bot_auth"},{"rule_id":"AB-059","title":"Bot Directory Members","category":"bot_auth"},{"rule_id":"AB-060","title":"Bot Public Keys","category":"bot_auth"},{"rule_id":"AB-067","title":"Web Bot Auth Directory","category":"bot_auth"},{"rule_id":"AB-128","title":"OAuth2 preferred over static API keys","category":"bot_auth"},{"rule_id":"AB-129","title":"Credentials via headers not query params","category":"bot_auth"},{"rule_id":"AB-130","title":"OAuth scopes defined","category":"bot_auth"},{"rule_id":"AB-131","title":"Token revocation endpoint available","category":"bot_auth"},{"rule_id":"AB-132","title":"Token introspection supported","category":"bot_auth"}]}