Lab: audit what 1Claw discloses about itself

Every lesson in this track has asked you to hold your own systems to a standard: disclose what is needed, log what matters, retain what regulators will ask about. This lab holds 1Claw to that same standard, using only what it publishes about itself.

1. 1

   Fetch the AI catalog entry, which is 1Claw's own disclosure of what it operates and how to reach it.

   code Copy

   curl -s https://1claw.co/.well-known/ai-catalog.json | python3 -c '
   import json, sys
   d = json.load(sys.stdin)
   print("host:   ", d["host"]["displayName"])
   print("entries:", [e["type"] for e in d["entries"]])
   '

2. 2

   A declared host identity and a typed list of everything it discloses: an MCP server card, an A2A agent card, and an OpenAPI spec.

   text Copy

   host:    1Claw
   entries: ['application/mcp-server-card+json', 'application/a2a-agent-card+json', 'application/openapi+json']

3. 3

   Cross-check that against the OAuth protected-resource metadata, which is a second, independent disclosure of the same API.

   code Copy

   curl -s https://1claw.co/.well-known/oauth-protected-resource | python3 -c '
   import json, sys
   d = json.load(sys.stdin)
   print("resource:", d.get("resource"))
   print("auth servers:", d.get("authorization_servers"))
   '

4. 4

   Two independently maintained files agreeing on the same issuer is exactly the kind of corroboration an auditor looks for.

   text Copy

   resource: https://1claw.co
   auth servers: ['https://api.1claw.co']

Nothing here required 1Claw's cooperation beyond what they already publish for exactly this purpose. That is the point: a vendor whose architecture is verifiable from public metadata is giving you the same thing the audit-and-compliance lesson asked you to give your own auditors.

• Independent corroboration matters more than a single disclosure. One file claiming an architecture is a statement; two separately-maintained files agreeing on the same issuer is evidence.
• This is a smaller version of the same negative-assurance problem from the audit lab. These files tell you what is disclosed, not that nothing is missing, and a vendor's well-known directory is not a complete architecture diagram.
• The exercise generalises past 1Claw. Before adopting any vendor into a system you will be audited on, check what they disclose about themselves the same way, unprompted, before you ask them a single question directly.