# GisForWeb auth.md

## Public access for agents

GisForWeb is a public GIS tools directory. Its catalog and read-only agent tools use anonymous access: no registration, API key, bearer token, cookies or payment are required.

There is no agent provisioning endpoint, OAuth authorization server or protected-resource flow. Do not send credentials to these public endpoints.

## Supported methods

- `GET /tools.json`: retrieve the public catalog as JSON.
- `GET /search.json`: retrieve the site's search index as JSON.
- `GET /llms.txt`: discover profiles, guides and public interfaces.
- `GET /tools/{slug}.md`: read an individual profile.
- `GET` a public content page with `Accept: text/markdown`: read its Markdown representation.
- `POST /mcp`: invoke the read-only Model Context Protocol service using Streamable HTTP. Include `Content-Type: application/json` and `Accept: application/json, text/event-stream`.

The MCP service supports `initialize`, `ping`, `tools/list` and `tools/call`, with the tools `search_gis_tools` and `get_gis_tool`. It is stateless and issues no session IDs or credentials. Use the negotiated `MCP-Protocol-Version` on requests after initialization.

## Submission and subscription forms

The public tool submission and newsletter forms are separate human-facing workflows with spam protection. Their `/api/` handlers are not agent catalog APIs. The agent tools do not submit forms or bypass their protections.

## Discovery and policy

- [Developer documentation](https://gisforweb.com/developers/)
- [API catalog](https://gisforweb.com/.well-known/api-catalog)
- [MCP server card](https://gisforweb.com/.well-known/mcp/server-card.json)
- [Content policy](https://gisforweb.com/robots.txt): search and AI input for answers are allowed; model training is disallowed.