# Auth.md

Agent access for clarwiz.com.

Last updated: September 2026

## Status

Clarwiz (clarwiz.com) is an informational website with two programmatic
entry points, both **public and anonymous**:

- `POST /mcp`, an MCP server (Streamable HTTP, stateless). Server Card at
  `/.well-known/mcp/server-card.json`.
- `POST /api/lead`, a working-session request. Described in `/openapi.json`.

There is **no protected resource, no OAuth or OIDC issuer, and no agent
registration endpoint**. That is why `/.well-known/openid-configuration`,
`/.well-known/oauth-authorization-server` and
`/.well-known/oauth-protected-resource` do not exist here. Their absence is
intentional: publishing issuer or token endpoints that do not exist would only
break your client.

## Agent audience

Any AI agent acting for a person who wants to understand Clarwiz, book a
demo, or ask the Clarwiz team for a working session. Registries and crawlers
indexing agent-facing resources are equally welcome.

## Registration

None. There is nothing to register and no account is created. Connect to
`/mcp` or call `/api/lead` directly.

## Supported methods

| Method      | Where                         | Credential      |
| ----------- | ----------------------------- | --------------- |
| `anonymous` | `POST /mcp`, `POST /api/lead` | none required   |

No bearer tokens, API keys, client certificates or signed assertions are
accepted or needed. An `Authorization` header, if sent, is ignored.

## Credential use

There are no credentials to obtain, present, rotate, claim or revoke.

## What agents can use

- `POST /mcp`, tools `get_clarwiz_overview`, `list_pages`,
  `get_demo_booking_link`, `request_working_session`, plus resources for the
  documents below
- `GET /llms.txt`, a plain-language briefing on what Clarwiz is
- `GET /index.md`, the homepage as markdown
- `GET /openapi.json`, the HTTP API description
- `GET /.well-known/ai-catalog.json`, the ARD capability manifest
- `GET /.well-known/api-catalog`, an RFC 9727 linkset of machine-readable resources
- `GET /.well-known/agent-skills/index.json`, the published agent skills

## Side effects and consent

The only operation with a side effect is a working-session request
(`request_working_session` over MCP, or `POST /api/lead`). It emails the
Clarwiz team, who reply to the address given. The website form also sends
the person an acknowledgement; the MCP tool does not, so an anonymous
caller cannot make clarwiz.com email a third party. Send a person's name
and work email only with their consent, and once per request. Requests
over MCP are rate limited per client address and per server; excess
requests get a tool error and are not delivered.

## Registering interest another way

Email **team@clarwiz.com**, or open the calendar the `get_demo_booking_link`
tool returns and let the person pick a slot. A person replies, which is
rather the point of the product.

When Clarwiz ships a protected API or agent registration, this file and the
well-known endpoints above will announce it first.