# convert probes, 2026-09-17T16:15Z, from a cloud container (one IP), no credentials, no payment
# Bodies are cut at 1500 bytes. Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.ai.app.convert.com/mcp
$ curl -sS -i -m 25 -X POST https://mcp.ai.app.convert.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 16:15:19 GMT
content-length: 0
cache-control: no-store
www-authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.ai.app.convert.com/.well-known/oauth-protected-resource/mcp", scope="convert.mcp"
pragma: no-cache
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BZaC%2BMldZHhYLYWbigonql0CIRkAjM4SAvNRpLWnEreGWt2zKJOV6u9St1BnxLcHYG3UZwp1qvEbrLijrFHmiURgTN0MhVnjKtjDVg2%2BOlc0naGR7TDNe2C8lMuRx%2Bj2rDUDGY1SRVh8"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: a3c968b06c9c611c-BOS
alt-svc: h3=":443"; ma=86400



## 2. Protected-resource metadata, GET https://mcp.ai.app.convert.com/.well-known/oauth-protected-resource/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 16:15:19 GMT
content-type: application/json; charset=utf-8
content-length: 404
cache-control: no-store
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xUb1108SyDNv5rO0HVWjrfuexs5YKBeOMnO1Yjb6gg2E0gbotxXJsgYa3RTC7eKazk1nq%2FGbJ37sRwMqBZvuXN4Be0j0K8TZ2zgvS0XSpeVIjW%2FC%2FKMov0b%2BGP%2FBLLM%2FJb0AHjS59GXO"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: a3c968b47e65a369-BOS
alt-svc: h3=":443"; ma=86400

{"resource":"https://mcp.ai.app.convert.com/mcp","authorization_servers":["https://mcp.ai.app.convert.com"],"scopes_supported":["convert.mcp"],"bearer_methods_supported":["header"],"resource_name":"Convert MCP","logo_uri":"https://mcp.ai.app.convert.com/convert-icon-512.png?v=ce018316","service_documentation":"https://mcp.ai.app.convert.com/","resource_documentation":"https://mcp.ai.app.convert.com/"}

## 3. Authorization-server metadata, GET https://mcp.ai.app.convert.com/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 16:15:20 GMT
content-type: application/json; charset=utf-8
content-length: 893
cache-control: no-store
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rZ0ixzFi0wB8Msu%2BUz8CtCmfeAcMuB%2FgeSDBU1ZDmaDUcz18JNR2b%2F24co3n8Enm65YY4BcOyuIG7azDb9tdtoNGp%2F6ENdUwlfFUh1CVjbFDPRUugDKvY00t8UKb2lemfXD1oeU19s4y"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: a3c968b86e563c31-BOS
alt-svc: h3=":443"; ma=86400

{"issuer":"https://mcp.ai.app.convert.com","authorization_endpoint":"https://mcp.ai.app.convert.com/authorize","token_endpoint":"https://mcp.ai.app.convert.com/token","registration_endpoint":"https://mcp.ai.app.convert.com/register","scopes_supported":["convert.mcp"],"response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"],"revocation_endpoint":"https://mcp.ai.app.convert.com/token","code_challenge_methods_supported":["S256"],"authorization_response_iss_parameter_supported":true,"client_id_metadata_document_supported":true,"logo_uri":"https://mcp.ai.app.convert.com/convert-icon-512.png?v=ce018316","service_documentation":"https://mcp.ai.app.convert.com/","resource_documentation":"https://mcp.ai.app.convert.com/"}

## 4. REST, GET https://api.convert.com/api/v2/accounts, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 16:15:21 GMT
content-type: application/json
server: Apache
x-privacy-policy: You can find our privacy policy at https://www.convert.com/privacy-notice/
vary: Origin
x-frame-options: deny
access-control-allow-credentials: true
content-security-policy: default-src * 'self' data: 'unsafe-inline' 'unsafe-eval' blob: https://*; form-action 'self'; base-uri 'self'; frame-ancestors 'self' https://*.convert.com
x-content-type-options: "nosniff"
x-xss-protection: "1; mode=block"
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, PATCH
access-control-allow-headers: Authorization, Accept, Accept-Encoding, Accept-Language, Connection, Content-Type, Convert-Application-ID, Expires, Origin, X-Requested-With, Host, Referer, Sec-Fetch-Mode, Sec-Fetch-Site, User-Agent, x-convert-nonce, x-convert-legacy, X-File-Name, Report-Token, X-Report-Backend, X-Convert-Source
cache-control: no-cache, private

{"code":401,"message":"UNAUTHORIZED","isError":true}