# Auth.md: agent authentication for projects.xyspace.dev

This host serves public Space & Story reports. Reading content and calling the
read-only MCP server require **no authentication**.

## Reading
All report content is public. Send `Accept: text/markdown` for a clean Markdown
rendering, or fetch `/ontario-agent-ready/index.md` directly.

## MCP
- Endpoint: https://projects.xyspace.dev/ontario-agent-ready/mcp
- Transport: MCP Streamable HTTP (JSON-RPC 2.0 over POST)
- Auth: none (read-only tools and resources)
- Server card: /.well-known/mcp/server-card.json

## Agent registration
This is an open, read-only service, so authentication is optional. An agent may
call the MCP server directly with no credentials. Agents that want to present an
identity can register anonymously and receive an optional `report:read`
credential.

- Registration endpoint: https://projects.xyspace.dev/oauth/register
- Method: anonymous (OAuth 2.0 public client, no client secret)
- Credential type: `oauth_access_token`, a Bearer token scoped `report:read`
- Metadata: /.well-known/oauth-authorization-server (see the `agent_auth` block)
  and /.well-known/oauth-protected-resource

To register, POST to the registration endpoint. The response returns the
anonymous `client_id` and a ready-to-use `report:read` Bearer `access_token`.
Present it to the MCP server as `Authorization: Bearer <access_token>`. Because
the service is read-only, unauthenticated requests are also accepted. The full
identity, credential, and claim metadata is published in the
authorization-server document referenced above.

## agent_auth
Machine-readable agent-registration metadata, also published in
/.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource:

```json
{
  "agent_auth": {
    "skill": "https://isitagentready.com/.well-known/agent-skills/auth-md/SKILL.md",
    "register_uri": "https://projects.xyspace.dev/oauth/register",
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": ["oauth_access_token"],
      "claim_uri": "https://projects.xyspace.dev/oauth/register"
    }
  }
}
```

## Contact
Space & Story: https://spaceandstory.co