# auth.md

Agent authentication and registration for `www.marian.coach`.

Last updated: 2026-09-04

## Summary

**No authentication is required. There is nothing to register for.**

Every machine-readable surface on this site is public, authless and free to
call. There is no OAuth authorization server, no API key, no account, and no
rate-limit tier that registration would unlock. This document exists so an
agent can establish that fact without probing for credentials.

## Audience

Autonomous agents and AI assistants that want to call the Engineering
Leadership Toolkit MCP server, or read this site's content as Markdown.

## Endpoints and how to call them

| Surface | URL | Method | Credentials |
|---|---|---|---|
| MCP server, leadership toolkit | `https://www.marian.coach/mcp` | JSON-RPC over POST | none |
| MCP server, mentoring inquiry | `https://www.marian.coach/mcp/mentoring` | JSON-RPC over POST | none |
| REST mirror of the mentoring server | `https://www.marian.coach/mcp/mentoring/api/openapi.json` | GET | none |
| Site profile for language models | `https://www.marian.coach/llms.txt` | GET | none |
| Long-form content corpus | `https://www.marian.coach/llms-full.txt` | GET | none |
| Markdown twin of any page | append `.md` to the page path | GET | none |
| Index of every Markdown twin | `https://www.marian.coach/md-sitemap.txt` | GET | none |
| MCP server card | `https://www.marian.coach/.well-known/mcp/server-card.json` | GET | none |
| A2A agent card | `https://www.marian.coach/.well-known/agent-card.json` | GET | none |
| Agent Skills index | `https://www.marian.coach/.well-known/agent-skills/index.json` | GET | none |
| API catalog | `https://www.marian.coach/.well-known/api-catalog` | GET | none |

### Registration

Not applicable. There is no registration endpoint, because there is no
credential to issue. An agent that has found this file already has everything
it needs to call every endpoint above.

### Credential use

None. Do not send an `Authorization` header — it is ignored. Do not attempt a
client-registration or token exchange against this origin; no such endpoint
exists and any URL that appears to offer one is not operated by this site.

## OAuth metadata

Deliberately absent. This site publishes no
`/.well-known/oauth-authorization-server`,
`/.well-known/oauth-protected-resource` or
`/.well-known/openid-configuration`, because it runs no authorization server
and protects no resource. Publishing those documents would describe endpoints
that do not exist and would send agents into a flow that cannot complete.

If that changes, this file changes with it.

## Other agent protocols

Absent for the same reason, and worth stating so nobody adds them by mistake.

**Web Bot Auth.** No `/.well-known/http-message-signatures-directory`. That
directory belongs to the party that sends signed requests, not the one that
receives them. This site runs no crawler that signs its traffic, so the file
would publish keys that sign nothing.

**Agentic commerce.** No ACP, AP2, MPP, UCP or x402 documents. Nothing here is
sold to an agent. Mentoring is booked with a person, and the calculators are
free to call. There is no checkout for a bot to finish and no wallet behind one.

A scanner that grades this site will mark those items incomplete. That is the
correct result, not a gap to close.

## Usage expectations

The endpoints are open, not unlimited. Please identify yourself with a real
`User-Agent`, and keep request rates reasonable. Crawler policy for training
and search is stated separately in
[`/robots.txt`](https://www.marian.coach/robots.txt).

## Contact

marian@marian.coach