RFC 8615 — Well-Known URIs

Discovery · IETF · IANA registry · Updated 2026-07-19

Status: Proposed Standard (IETF), published May 2019; a revision draft (rfc8615bis) is circulating as an individual draft · Authoritative source

The quiet workhorse of agent discovery: the /.well-known/ path prefix that gives machines a fixed place to look for a site’s metadata — and the IANA registry that says which names are real.

RFC 8615 (2019, obsoleting RFC 5785) reserves the /.well-known/ path prefix and establishes an IANA registry for names under it. Practically the whole agent-discovery layer lives there: A2A agent cards, x402 payment manifests, MCP discovery files, OAuth metadata, signature key directories.

The registry is also a useful reality check on the ecosystem’s maturity. As of mid-2026, the agent-relevant names actually registered are agent-card.json (registered August 2025, change-controlled by the Linux Foundation for the A2A spec) and api-catalog (RFC 9727). Everything else the agentic web uses — x402.json, mcp.json, webmcp.json — is convention, not registration. Registration isn’t required for a name to work, but it is the difference between “a spec owns this name” and “everyone hopes nobody collides.”

A revision, draft-nottingham-rfc8615bis, is circulating as an individual draft (February 2026) to refresh the well-known governance rules as usage explodes.

The agent-discovery layer under /.well-known/

/.well-known/agent-card.json     ← A2A (IANA-registered)
/.well-known/x402.json           ← x402 discovery (convention)
/.well-known/mcp.json            ← MCP manifest (convention)
/.well-known/http-message-signatures-directory ← RFC 9421 keys

How AgentGrade checks it

A large share of the scanner’s discovery checks are well-known probes: the A2A agent card (current and legacy paths), x402.json field validation, the MCP manifest, the WebMCP manifest, and the signatures directory. Scan your site to see where you stand.

Related

• A2A — the agent card that lives here
• x402 — the payment manifest that lives here
• Identity — OAuth and trust metadata

All standards

RFC 9421 · Web Bot Auth · RFC 8615 · MCP · A2A · x402 · WebMCP · llms.txt · RFC 9309 · RFC 9110 · Index