Probe-verified diagnosis: orank reads the ON-SITE surfaces, not the registry. The 8.37.0 fixes existed but were invisible to it.
| Check (still failing) | Where checker looks | Fix |
|---|---|---|
| mcp-multi-surface 0/2 | /.well-known/mcp/server-card.json — listed ONE remote | card now carries packages[] (OCI stdio) + transports[] |
| api-versioning-policy 2/3 | API headers + discoverable pages | Link: </api-policy.md>; rel="deprecation" on every response + api-catalog item |
| rest-sdk-packages 1/3 | OpenAPI + docs surfaces | OpenAPI description: pip install orchestkit-hook-contract + docker run; api-catalog PyPI item |
| oauth-protected-resource 0/2 + walkthrough 0/2 + agent-auth-discovery 0/3 | /.well-known/oauth-protected-resource — was an intentional 404 | anonymous-only RFC 9728 PRM: resource + EMPTY authorization_servers/bearer_methods (truthful — no AS exists, no token read); auth.md Discover rewritten with live sample payloads; walkthrough declared N/A by design |
| nlweb-ask 0/1 | checker bug — /ask verified live: bare 400 Problem, query/question/q aliases all 200, SSE works | feedback #68/#69 filed, no code change |
# server-card.json before → after "remotes": [{ "type": "streamable-http", ... }] + "packages": [{ "registryType": "oci", "identifier": "ghcr.io/yonatangross/orchestkit-docs-mcp", + "runtimeHint": "docker", "transport": { "type": "stdio" } }] + "transports": ["streamable-http", "stdio"]