# AgentCapable: authentication

There is none, by design. Every public read surface is open (the
machine-readable API surfaces are additionally CORS-enabled), and scans are
attributed by contact details in the request body instead of an API key.
The exceptions, precisely: the operator's own internal dashboard is gated
and not part of the public API, and the CLI-vantage upload is the one
credentialed public WRITE (details below).

## What each surface requires

- POST https://agentcapable.dev/scan: no auth. The JSON body must carry
  {"lead": {"name": "...", "email": "..."}}; the report link is emailed there.
  Same policy on every scan surface (web form, API, MCP tool, CLI).
- GET /api/checks, /openapi.json: open reads, no auth, CORS enabled.
- GET /r/{scanId}, /badge/{domain}.svg, /methodology.md, /llms.txt: open
  reads, no auth.
- MCP server (POST https://agentcapable.dev/mcp): no auth
  ("authentication": {"type": "none"} in /.well-known/mcp.json).
- CLI (npx agentcapable): no account. Hosted scans carry the same lead
  contact details as the web form.

## The one credential that exists

A fresh, successfully archived scan response can include a single-purpose
cliUploadToken. It authorizes
exactly one thing: uploading that same scan's user-network vantage rerun
(POST /r/{scanId}/cli-vantage) so the CLI can merge a third vantage into the
hosted report. It is scoped to that one scan, accepted once (a second upload
is refused), and never included in shareable report links, which are
read-only.

## No OAuth, no API keys, no accounts

There are no user accounts, no OAuth flow, no scoped permissions, and no
user-issued credential a leak could expose. To be precise about what IS
stored: the contact details you submit with a scan (to attribute it and
email the report; see https://agentcapable.dev/privacy), and the operator's
own service secrets (payments, email delivery), which never gate your
access. If a future paid surface ever needs a credential, it will be
documented here first.

Questions: support@agentcapable.dev. More for agents:
https://agentcapable.dev/agents.md and https://agentcapable.dev/llms.txt.