# auth.md — Maker Machines Atlas access instructions

## Audience and credentials

AI assistants and MCP clients may use our public, read-only research tools without
authentication. No account, API key, bearer token, OAuth flow or registration is
required. Do not ask users to share credentials or send an Authorization header.
There is no account-provisioning endpoint. This document explains public access;
it does not implement the WorkOS Auth.md agent-registration protocol.

## Connect

- Endpoint: https://makermachinesatlas.com/mcp
- Transport: MCP Streamable HTTP, POST JSON-RPC.
- Send Content-Type: application/json and Accept: application/json, text/event-stream.
- Initialize the MCP connection before calling tools/list or tools/call. Negotiate
  a protocol version supported by the server; do not infer it from the server release.
- Server metadata: https://makermachinesatlas.com/.well-known/mcp/server-card.json
- Tool descriptions and limitations: https://makermachinesatlas.com/llms.txt
- API catalog: https://makermachinesatlas.com/.well-known/api-catalog

Native MCP clients can connect directly. Browser requests must originate from
https://makermachinesatlas.com; cross-origin browser calls are rejected. Public CORS
on discovery documents does not grant cross-origin access to the tool endpoint.
GET /mcp returns 405 by design: no standalone SSE stream or session storage is offered.

## Limits and errors

POST bodies are limited to 16 KiB. A best-effort limit of 60 requests per IP per
minute applies. Respect Retry-After on HTTP 429 and avoid parallel retry storms.
HTTP 413 means the body is too large; 403 may indicate an invalid Origin or host.
An authentication error is not a request to invent credentials: check the endpoint
and client configuration rather than registering an account.

## Data handling and scope

Supply only the explicit machine, buyer country, currency and calculation inputs
needed for the task. Do not submit passwords, payment details or personal data.
Application code does not persist or log submitted inputs; hosting/platform logs
are outside that guarantee. Results use dated sources, not confirmed live stock
or current seller quotes. Preserve source dates, uncertainty and affiliate disclosures.

The tools cannot purchase products, process payments, manage orders or access
private accounts. Retailer checkout and its authentication remain with the seller.