# docusign probes, 2026-09-18T12:04Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 20000 (tools/list), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.docusign.com/mcp
$ curl -sS -i -m 25 -X POST https://mcp.docusign.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 403 
content-length: 19
content-type: text/plain
date: Fri, 18 Sep 2026 12:04:19 GMT
strict-transport-security: max-age=63072000; includeSubDomains
x-content-type-options: nosniff
x-request-id: a95dfb69-32e3-9dbb-96e8-abbeb6e98822,a95dfb69-32e3-9dbb-96e8-abbeb6e98822
traceparent: 00-875c06e0cd4d6825b6ffa7d6be290442-3f636c5249a2986c-01
traceparent: 00-875c06e0cd4d6825b6ffa7d6be290442-3f636c5249a2986c-01
ratelimit-limit: 800
ratelimit-remaining: 798
ratelimit-reset: 0

RBAC: access denied

## 2. Protected-resource metadata, GET https://mcp.docusign.com/.well-known/oauth-protected-resource/mcp (not named in the challenge; the path-aware well-known URI, the first fallback the specification names)
HTTP/1.1 200 Connection Established

HTTP/2 403 
content-length: 19
content-type: text/plain
date: Fri, 18 Sep 2026 12:04:20 GMT
strict-transport-security: max-age=63072000; includeSubDomains
x-content-type-options: nosniff
x-request-id: f660ccc0-c3b5-98d6-aea7-d8cd1e205c01,f660ccc0-c3b5-98d6-aea7-d8cd1e205c01
traceparent: 00-0964fd69bac2516320ff21a073658530-3557a6c6c27653f1-01
traceparent: 00-0964fd69bac2516320ff21a073658530-3557a6c6c27653f1-01
ratelimit-limit: 800
ratelimit-remaining: 798
ratelimit-reset: 0

RBAC: access denied

## 2b. Protected-resource metadata, GET https://mcp.docusign.com/.well-known/oauth-protected-resource (the root well-known URI, the second fallback; tried because step 2 answered 403, not 200)
HTTP/1.1 200 Connection Established

HTTP/2 200 
vary: Origin, Accept-Encoding
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-dns-prefetch-control: off
expect-ct: max-age=0
x-frame-options: SAMEORIGIN
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
x-xss-protection: 0
traceresponse: 00-3903fae261a62a1e4997e96597c3ac37-feb5f8b48d233b1d-01
x-docusign-tracetoken: [redacted by the prober after the run: a per-request trace id the publish door reads as a key]
content-type: application/json; charset=utf-8
content-length: 318
etag: W/"13e-lp5VMmkWmiNuQv/Xs2w2dx8PZZg"
date: Fri, 18 Sep 2026 12:04:21 GMT
strict-transport-security: max-age=63072000; includeSubDomains
x-content-type-options: nosniff
x-request-id: a7f92736-7f8c-97c7-81c7-ba0aaf6d887c,a7f92736-7f8c-97c7-81c7-ba0aaf6d887c
traceparent: 00-3903fae261a62a1e4997e96597c3ac37-4769ec2599dfb947-01
traceparent: 00-3903fae261a62a1e4997e96597c3ac37-4769ec2599dfb947-01
ratelimit-limit: 800
ratelimit-remaining: 799
ratelimit-reset: 0

{"resource":"https://mcp.docusign.com/mcp","resource_name":"Docusign MCP","authorization_servers":["https://mcp.docusign.com"],"bearer_methods_supported":["header"],"scopes_supported":["adm_store_unified_repo_read","aow_manage","signature"],"resource_documentation":"https://developers.docusign.com/tools/mcp-server/"}

## 3. Authorization-server metadata, GET https://mcp.docusign.com/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
vary: Origin, Accept-Encoding
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-dns-prefetch-control: off
expect-ct: max-age=0
x-frame-options: SAMEORIGIN
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
x-xss-protection: 0
traceresponse: 00-90085866d1d7104a21e38886cdb21f83-4aa28df2ea474374-01
x-docusign-tracetoken: [redacted by the prober after the run: a per-request trace id the publish door reads as a key]
content-type: application/json; charset=utf-8
content-length: 387
etag: W/"183-sw+GTx8/yoOfx6G6no/4T7aA77Y"
date: Fri, 18 Sep 2026 12:04:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains
x-content-type-options: nosniff
x-request-id: 316aebc7-a1ab-91ce-a313-11ed73156459,316aebc7-a1ab-91ce-a313-11ed73156459
traceparent: 00-90085866d1d7104a21e38886cdb21f83-4106abdf4f9075f5-01
traceparent: 00-90085866d1d7104a21e38886cdb21f83-4106abdf4f9075f5-01
ratelimit-limit: 800
ratelimit-remaining: 799
ratelimit-reset: 0

{"issuer":"https://account.docusign.com","authorization_endpoint":"https://account.docusign.com/oauth/auth","token_endpoint":"https://account.docusign.com/oauth/token","grant_types_supported":["authorization_code","refresh_token"],"response_types_supported":["code"],"code_challenge_methods_supported":["S256"],"scopes_supported":["adm_store_unified_repo_read","aow_manage","signature"]}

## 4. REST, GET https://account.docusign.com/oauth/userinfo, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 400 
cache-control: no-cache
pragma: no-cache
content-type: application/json; charset=utf-8
expires: -1
x-docusign-tracetoken: [redacted by the prober after the run: a per-request trace id the publish door reads as a key]
x-docusign-node: E2ESE3FE10P11
strict-transport-security: max-age=63072000; includeSubDomains; preload
referrer-policy: no-referrer,strict-origin-when-cross-origin
x-content-type-options: nosniff
date: Fri, 18 Sep 2026 12:04:22 GMT
content-length: 87
vary: Accept-Encoding

{"error":"internal_server_error","reference_id":"[redacted by the prober after the run: the same per-request trace id]"}