# auth.md

> Agent authentication guide for **Wildcast** — activity-specific outdoor weather
> and Good Time Scores for the UK, built by Wildfire Gin.

This file tells AI agents how to authenticate with Wildcast's machine-readable
API. **Short version: you don't need to.** Wildcast's tools are public and
read-only, so there is no sign-up, no API key, and no OAuth flow to complete.

- **Resource server (API base):** `https://tzkukkxxkfzbcpnkcnjy.supabase.co/functions/v1/mcp`
  — a Model Context Protocol (Streamable HTTP, JSON-RPC) server.
- **Human/agent connection guide:** `https://wildcast.wildfiregin.com/connect`
- **API catalog (RFC 9727):** `https://wildcast.wildfiregin.com/.well-known/api-catalog`
- **Overview for LLMs:** `https://wildcast.wildfiregin.com/llms.txt`

## 1. Who this is for

MCP clients (ChatGPT, Claude, Cursor, MCP Inspector), browser agents, and
crawlers that want live UK outdoor weather forecasts, activity-specific
**Good Time Scores**, best-time windows, and shareable forecast links.

## 2. Authentication: none required

Wildcast exposes only intentionally public, read-only data (weather forecasts
derived from the keyless Open-Meteo API). There are **no user accounts** on
Wildcast, so:

- **No registration.** There is no `register_uri` — an agent does not create or
  claim an account to call these tools.
- **No credentials.** No API key, no bearer token, no client secret, no OAuth
  authorization server, and no `WWW-Authenticate` challenge. Requests are
  unauthenticated.
- **No per-user data.** Nothing is scoped to an identity, so there is nothing to
  authorize.

Because there is no protected resource, there is deliberately **no**
`/.well-known/oauth-protected-resource` or `/.well-known/oauth-authorization-server`
document. Publishing one would advertise endpoints that do not exist.

## 3. How to connect

1. Point your MCP client at the resource server URL above.
2. Send requests directly — omit any `Authorization` header.
3. See `/connect` for a step-by-step client configuration walkthrough, or
   `/.well-known/api-catalog` for the full machine-readable resource list.

Example MCP client configuration:

```json
{ "mcpServers": { "wildcast": { "url": "https://tzkukkxxkfzbcpnkcnjy.supabase.co/functions/v1/mcp" } } }
```

## 4. Limits and data

- **Rate limit:** ~60 requests/minute per IP (token bucket). No account raises it.
- **Data source:** Open-Meteo (keyless). Forecasts are cached briefly server-side.
- **Not a safety guarantee:** the Good Time Score is a planning aid, not official
  Met Office guidance or a safety assurance.

## 5. Future

If Wildcast later adds authenticated, per-user features, Protected Resource
Metadata at `/.well-known/oauth-protected-resource` will become the authoritative
source for endpoints and supported flows, and this file will point back at it.
Until then, no authentication is needed or offered.