# IsAgentReady auth.md

Authentication guide for agents. The IsAgentReady API and MCP server are public
and read-only: no API key, token, OAuth flow or registration is required to
scan a site, retrieve results, or read rankings.

## Agent audience

Any agent (MCP client, A2A client, HTTP client) may call the public
endpoints anonymously. Identify yourself with a descriptive User-Agent.

## Endpoints

- MCP (Streamable HTTP): https://isagentready.com/mcp
- A2A (HTTP+JSON): https://isagentready.com/a2a/v1
- JSON API: https://isagentready.com/api/v1
- OpenAPI spec: https://isagentready.com/openapi.json

## Auth scheme

None for the public surface. Send requests directly. There is no OAuth
Authorization Server or OpenID Connect provider for this service, so
https://isagentready.com/.well-known/oauth-authorization-server and
https://isagentready.com/.well-known/openid-configuration are intentionally not provided.

Monitoring endpoints (`/api/v1/monitoring/*`) are owner-scoped: they use a
bearer management token that is issued to the verified site owner by email
after domain ownership verification. Agents cannot self-register for it;
the owner hands the token to the agent they trust. Send it as
`Authorization: Bearer <token>`.

## Agent registration

Registration methods supported:

- `anonymous`: the public scan, rankings, MCP and A2A surface. No account,
  registration or credential is created; call the endpoints directly.
- `owner_token` (provisioning): monitoring management tokens are provisioned
  through the site claim flow. Provisioning endpoint:
  `POST https://isagentready.com/api/v1/monitoring/sites` (claim), then
  `POST https://isagentready.com/api/v1/monitoring/sites/{site_id}/verify` after the DNS
  or well-known ownership challenge. The credential is a bearer token sent
  to the verified owner's email; it is used as `Authorization: Bearer` on
  `/api/v1/monitoring/*` only and can be rotated via the recovery endpoint.

There is no `POST /agent/auth` registration endpoint. Machine-readable
summary (Auth.md agent_auth metadata):

```json
{
  "agent_auth": {
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": ["none"],
      "claim_uri": "https://isagentready.com/api/v1"
    },
    "register_uri": null,
    "provisioning": {
      "owner_token": "https://isagentready.com/api/v1/monitoring/sites"
    }
  }
}
```

## Rate limits

Every API, MCP and A2A response carries `RateLimit-Policy`, `RateLimit`,
`RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` headers. A
limited response is HTTP 429 with `Retry-After`. Prefer cached results
(`get_scan_results`) over repeated scans.