# auth.md — Resilient World agent registration

This document describes how agents discover and optionally register for the public marketing MCP at https://resilient.world/mcp.

## Current access model

The public MCP at https://resilient.world/mcp is **unauthenticated and anonymous by default**. All tools return read-only marketing facts from existing resilient.world copy. No login, SSO, customer API access, or paid product API exists on this site.

Optional OAuth discovery is provided so agents can obtain a clearly-labeled **public anonymous bearer token** when a scanner or client expects OAuth metadata. Tokens are not required to call the MCP today.

## Discovery

1. Fetch Protected Resource Metadata (RFC 9728): https://resilient.world/.well-known/oauth-protected-resource
2. Fetch MCP Protected Resource Metadata (RFC 9728 path-insert): https://resilient.world/.well-known/oauth-protected-resource/mcp
3. Fetch Authorization Server metadata (RFC 8414): https://resilient.world/.well-known/oauth-authorization-server
4. Read this file: https://resilient.world/auth.md

## Protected resource (origin)

- Resource: https://resilient.world
- Authorization servers: https://resilient.world
- Scopes: mcp:read, mcp:tools
- Bearer methods: header

## Protected resource (MCP)

- Resource: https://resilient.world/mcp
- Authorization servers: https://resilient.world
- Scopes: mcp:read, mcp:tools
- Bearer methods: header

## OAuth endpoints

| Endpoint | URL |
| --- | --- |
| Authorization | https://resilient.world/oauth/authorize |
| Token | https://resilient.world/oauth/token |
| JWKS | https://resilient.world/oauth/jwks |
| Dynamic registration | https://resilient.world/oauth/register |
| Anonymous claim metadata | https://resilient.world/oauth/claim |

Issuer: https://resilient.world (must match PRM authorization_servers)

## agent_auth

```json
{
  "skill": "https://resilient.world/auth.md",
  "register_uri": "https://resilient.world/oauth/register",
  "claim_uri": "https://resilient.world/oauth/claim",
  "identity_types_supported": [
    "anonymous"
  ],
  "credential_types_supported": [
    "bearer"
  ],
  "anonymous": {
    "credential_types_supported": [
      "bearer"
    ],
    "claim_uri": "https://resilient.world/oauth/claim"
  },
  "registration_methods": [
    {
      "type": "anonymous",
      "method": "POST",
      "endpoint": "https://resilient.world/oauth/register",
      "grant_type": "client_credentials",
      "token_endpoint_auth_method": "none",
      "description": "Dynamic client registration for anonymous public MCP access. Tokens are optional; the MCP remains callable without authentication."
    }
  ]
}
```

### Registration flow (anonymous)

Complete standalone registration for the public marketing MCP:

1. **Discover** — Read this file and https://resilient.world/.well-known/oauth-authorization-server for agent_auth metadata.
2. **Claim metadata (optional)** — GET https://resilient.world/oauth/claim for anonymous claim metadata (no user PII; claim_required is false).
3. **Register** — POST https://resilient.world/oauth/register with JSON:

```json
{
  "client_name": "example-agent",
  "grant_types": ["client_credentials"],
  "token_endpoint_auth_method": "none"
}
```

4. **Token** — POST https://resilient.world/oauth/token with grant_type=client_credentials and the returned client_id (token_endpoint_auth_method: none).
5. **Use** — Call https://resilient.world/mcp with optional Authorization: Bearer <access_token>. The MCP is callable without a token.

The access token is a public anonymous JWT signed by https://resilient.world/oauth/jwks. Top-level claim_uri: https://resilient.world/oauth/claim.

## Limits

- Public MCP is unauthenticated by default; optional tokens are anonymous labels, not customer credentials.
- No user accounts, email verification, or customer claim ceremony on the marketing site.
- No customer data APIs, pricing APIs, or production product backends are exposed here.
- Do not treat these tokens as customer credentials; they only label optional anonymous access to public MCP tools.