# Auth.md

Agent authentication for Blazon Agency.

**Site:** https://blazonagency.com
**Last updated:** 2026-08-31
**TL;DR:** Public read-only marketing site. No agent registration or OAuth flow is required to read content. Contact enquiries must be completed by the user through the normal `/contact` form.

## Access summary

| Surface | Auth required | Notes |
|---|---|---|
| All HTML pages | None | Public. `Allow: /` in `robots.txt`. |
| `/llms.txt` | None | Plain-text site map for LLMs. |
| `/feed.xml` | None | RSS feed of `/insights` posts. |
| Sitemaps (`/sitemap-*.xml`) | None | Public. |
| Markdown negotiation (`Accept: text/markdown`) | None | Any page route returns Markdown via `Accept` negotiation. |
| WebMCP (`navigator.modelContext`) | None | 2 read-only tools registered on every page. See `/.well-known/mcp/server-card.json`. |
| `/contact` | Interactive browser | Lead submission requires the normal form, exact submission identity, consent evidence and Cloudflare Turnstile. |
| `GET /api/*` (other) | N/A | No other public read endpoints. Internal cron and webhook endpoints exist but are not addressable from the open internet without a shared secret. |

## What this site does **not** offer

- **No OAuth / OpenID Connect.** No protected resources, no user accounts, no authorization server. `/.well-known/oauth-authorization-server`, `/.well-known/openid-configuration`, and `/.well-known/oauth-protected-resource` intentionally do not exist.
- **No agent identity registration.** Agents do not need to register, request a client ID, or present credentials.
- **No paid endpoints.** No x402, MPP, UCP, or ACP commerce protocols. The site is a marketing site, not a transactional one.
- **No remote MCP server.** Tools are exposed via in-browser WebMCP only. There is no stdio, SSE, or Streamable HTTP MCP endpoint to connect to.

## Contact enquiries

WebMCP is read-only. Agents may direct a user to https://blazonagency.com/contact, but must not bypass the interactive form. The form captures a retry-safe exact event ID, the visitor's consent choice and a fresh Turnstile verification before any lead is accepted.

## Robots and content signals

`robots.txt` declares `Content-Signal: ai-train=yes, search=yes, ai-input=yes`. Translation: Blazon **wants** its content cited by AI tools, indexed by search, and used as training corpus. There is no need to obfuscate identity or avoid declaring you are an AI agent.

Per-bot rules are listed in `robots.txt` for GPTBot, ChatGPT-User, Google-Extended, CCBot, Anthropic-AI, Claude-User, PerplexityBot, Bytespider, CohereBot, Applebot-Extended, Amazonbot, and Meta-ExternalAgent.

## Discovery endpoints

- `/.well-known/api-catalog` — Linkset of public surfaces
- `/.well-known/agent-skills/index.json` — Agent Skills v0.2.0 read-only catalog (6 browse skills)
- `/.well-known/mcp/server-card.json` — MCP server card (WebMCP transport)
- `/llms.txt` — LLM-friendly site map
- `/sitemap-index.xml` — Sitemap index

## Contact for agent integrators

If you maintain an agent platform and want to discuss a deeper integration (server-side MCP, named partnership, structured lead handoff), email **hello@blazonagency.com** with subject `[Agent Integration]`.