# auth.md: texuli.com

> How AI agents and other automated clients access texuli.com: anonymously,
> read-only, with no registration and no credential.

## Audience

Agents (assistants, crawlers, MCP and A2A clients) that read `/auth.md`
before deciding how to authenticate.

## Access model

| Aspect | Value |
| --- | --- |
| Identity required | None: anonymous access |
| Credentials | None are needed and none are issued |
| Registration | None. There is no account system |
| Protected resources | None |
| Access | Read-only. Nothing on the site changes state for a request |

## What an agent can read

- Every page, as HTML, and its Markdown twin: the page URL plus `.md`
  (`/index.md` for the home page). The page's `Link` header and its head
  name it with `rel="alternate"; type="text/markdown"`, and a request that
  sends `Accept: text/markdown` to the page URL gets it.
- [https://texuli.com/llms.txt](https://texuli.com/llms.txt) (the site guide) and
  [https://texuli.com/llms-full.txt](https://texuli.com/llms-full.txt) (the full corpus).
- [https://texuli.com/.well-known/api-catalog](https://texuli.com/.well-known/api-catalog) (RFC 9727) and
  [https://texuli.com/.well-known/ai-catalog.json](https://texuli.com/.well-known/ai-catalog.json) (the resource catalog).
- [https://texuli.com/.well-known/agent-skills/index.json](https://texuli.com/.well-known/agent-skills/index.json) (the agent skills index).

## The MCP server

- **Endpoint:** `https://texuli.com/mcp` (also answered at `https://texuli.com/.well-known/mcp`).
- **Card:** [https://texuli.com/.well-known/mcp/server-card.json](https://texuli.com/.well-known/mcp/server-card.json).
- **Transport:** stateless Streamable HTTP. Send `POST` with a JSON-RPC
  message (or a batch of at most 10), `Content-Type: application/json`
  and an `Accept` that allows `application/json`. Responses are JSON; there
  is no SSE stream and no session.
- **Authentication:** none. Send no `Authorization` header.
- **Operations:** read-only (search, read and validate the catalog,
  examples, blueprints and themes). The server lists them in `tools/list`.

## The JSON API

- **Index:** [https://texuli.com/api/index.json](https://texuli.com/api/index.json); **OpenAPI:**
  [https://texuli.com/openapi.json](https://texuli.com/openapi.json); **portal:**
  [https://texuli.com/developers/](https://texuli.com/developers/).
- Read-only files under `/api/v1/` (`GET` and `HEAD`), anonymous, CORS `*`.
  Every answer carries `X-API-Version`; errors are RFC 9457
  `application/problem+json`.

## Limits

- 300 JSON API requests per client per 60 seconds under `/api/`, with the
  same `RateLimit-Policy`, `RateLimit` and `429` + `Retry-After` fields.
- 60 MCP messages per client per 60 seconds; each message in a
  batch counts. Every answer carries `RateLimit-Policy` and `RateLimit`
  headers. Past the limit the answer is `429` with `Retry-After`: wait
  that many seconds.
- A request body is at most 256 KB.
- Browsers may call the endpoint only from texuli.com. A server-side agent
  sends no `Origin` header and is allowed.

## OAuth discovery documents

For agents that probe the standard OAuth paths, the site publishes
discovery stubs that state the same thing as this file: anonymous,
read-only, nothing to register.

- [https://texuli.com/.well-known/oauth-protected-resource](https://texuli.com/.well-known/oauth-protected-resource) (RFC 9728)
- [https://texuli.com/.well-known/oauth-authorization-server](https://texuli.com/.well-known/oauth-authorization-server) (RFC 8414)

Their endpoints are reserved paths that accept no request. Do not probe
them.

## Contact

Security reports: security@dailybot.com (see
[https://texuli.com/.well-known/security.txt](https://texuli.com/.well-known/security.txt)).
Everything else: https://github.com/DailybotHQ/texuli.