Agent Hub

Ordered discovery (Edge contracts only)

Complete identity + auth discovery in this order. Do not use an unauthenticated GET/POST /mcp as a discovery probe. MCP is the invoke surface after the auth contract is known. No proprietary hub /.well-known/* — Edge / IdP only. DEV note: LIVE PAT exchange is the only auth method on development (OAuth DCR will fail due to Trusted Hosts policy). See agent-authentication discovery.

1. 1. Hub UI https://agents.a24labs.net this page (catalog / recipes pre-auth)
2. 2. Bootstrap https://edge.a24labs.net/.well-known/awp-eeg
3. 3. Auth discovery https://edge.a24labs.net/discovery/v1/authentication
4. 4. Protected Resource Metadata https://edge.a24labs.net/.well-known/oauth-protected-resource
5. 5. Authorization Server https://id.a24labs.net/realms/a24labs from PRM / bootstrap (IdP realm — environment-aware link)
6. 6. MCP invoke (after auth) https://edge.a24labs.net/mcp Path #1 Streamable HTTP — JWT / OAuth session; not a discovery probe