> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentlinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Protocol and account boundaries

> MCP transports, anonymous checks, OAuth discovery, human consent and non-product endpoints.

Connection, account consent and health endpoints have different jobs from product operations. They are intentional interface boundaries. [Shared operations](/reference/http/routes) document product calls; these protocol endpoints do not need equivalent CLI or MCP tools.

## MCP transport

`/mcp` serves the authenticated MCP server. `/free/mcp` serves only the anonymous `verify_link_free` tool. Use a compatible MCP client to initialize and negotiate the protocol, list tools and call a tool. POST carries JSON-RPC requests; GET and DELETE are transport-level methods whose handling depends on the negotiated stateless transport. Do not treat them as product reads/deletes or assume a persistent server session exists. An unsupported method or session can be refused by the transport.

Send a scoped bearer credential for `/mcp`. The configured provider verifies the principal before tool execution. Tool failures set `isError:true` and carry an error object in text content. Successful calls include structuredContent; ordinary authenticated calls also include JSON text. The anonymous tool's text is a Markdown handoff of the same structured result, including negative, unknown and failed check outcomes.

The public endpoint uses anonymous abuse budgets. A scoped credential does not turn its free result into a watch or bypass the anonymous budget. [HTTP conventions](/reference/http/conventions) cover request limits and browser-origin checks.

## Anonymous HTTP check

```bash theme={null}
curl --fail-with-body https://app.agentlinkops.com/free/check \
  -H 'Content-Type: application/json' \
  --data '{"sourceUrl":"https://publisher.example.com/post","targetUrl":"https://example.com/guide","scope":"exact"}'
```

POST `/free/check` accepts sourceUrl, targetUrl and optional scope, default exact. Scope accepts exact, domain, subdomain and path. The resource handler also accepts source\_url/target\_url and targetScope aliases; use the camelCase names above for new clients.

The public result state is success, valid-negative, unknown or failed. A complete negative is a result, not a server error. Invalid input returns 422, anonymous budget/cooling returns 429, and service failure returns 503. Unknown outcomes can return 200; inspect the result instead of treating HTTP success as link presence.

GET `/free/check/{resultId}` reads a retained public handoff result without credentials. A missing or expired result returns 404 RESULT\_NOT\_FOUND. Both routes return JSON by default and Markdown when Accept includes text/markdown. POST may set a signed visitor cookie used for anonymous limits. This surface does not create a workspace, cloud watch or local ledger. The local [single-check command](/reference/local/check-single) uses a distinct portable artifact contract.

## OAuth discovery and human consent

| Route                                         | Role                                                         |
| --------------------------------------------- | ------------------------------------------------------------ |
| GET /.well-known/oauth-protected-resource     | Protected resource metadata                                  |
| GET /.well-known/oauth-protected-resource/mcp | Resource metadata for the MCP endpoint                       |
| GET /.well-known/oauth-authorization-server   | Configured issuer metadata                                   |
| GET /authorize                                | Human consent page for the legacy provider flow              |
| POST /oauth/register                          | Legacy provider client registration                          |
| POST /oauth/token                             | Legacy provider token exchange and token revocation protocol |
| POST /auth/prepare                            | Prepare a human-reviewed legacy authorization request        |
| POST /auth/approve                            | Consume the prepared approval and authorize selected access  |
| POST /auth/clerk-grants                       | Authorize a client in the Clerk provider flow                |

Clients should follow discovered issuer metadata. Under Clerk, the resource metadata points to the configured Clerk issuer; authorization-server metadata is fetched from that issuer. Do not hardcode the legacy token endpoint for Clerk-issued credentials. Clerk metadata accepts GET and OPTIONS, and rejects other methods.

`/auth/prepare` requires a human identity and authorizationUrl belonging to this API origin's `/authorize` page. It returns approvalToken, client (name, id, redirect\_uri), requested scopes, expires\_at and resource. The prepared approval lasts ten minutes and binds the human session. `/auth/approve` requires workspace selection, approvalToken, approved scopes and optional projectIds. It consumes the approval and returns redirectTo. Legacy requests require PKCE S256.

`/auth/clerk-grants` requires a human workspace principal and Clerk mode. It accepts clientId (nonempty, no whitespace, at most 2048 characters), name (1 to 100 characters), scopes and optional projectIds. Access stays within the human's permission ceiling. It returns id, clientId, client\_name, scopes, projectIds and created\_at. These consent routes are app-owned account flows, separate from ordinary agent calls. [Human account access](/reference/http/account-access) covers credential creation and revocation.

## Configuration and operational endpoints

GET `/config` exposes public client configuration: clerkPublishableKey, clerkFrontendApi, apiOrigin, environment, mcpAuthProvider, clerkOAuthIssuer and capability flags for discovery, competitorRefresh, domainOverview, webhookDelivery and businessMeasurement. These flags describe configured server behavior; registry presence alone does not prove supplier admission.

GET `/healthz` returns service, environment, status and version. It proves process response only. GET `/readyz` checks required bindings and representative database access, returning ready or not\_ready. GET `/opsz` uses a separate operator credential for aggregate operating signals. It is outside customer API access and outside tool parity.

The Worker answers allowed-origin OPTIONS requests with its advertised method/header policy. Metadata discovery has its own CORS policy. The 8192-character URL cap, bounded body reads and configured request limiter apply at the Worker boundary as implemented.

## Website and telemetry exclusions

GET/HEAD assets, the app shell routes `/`, `/index.html`, `/app`, `/app/` and `/authorize`, agent brief files, static fonts/icons/scripts and documentation assets are website surfaces. They are not missing product commands.

`POST /measurement/consent`, `DELETE /measurement/consent` and `POST /measurement/events` belong to consent-based first-party browser measurement. They require the configured browser origin and applicable measurement flags/token, and are excluded from customer automation reference. Scheduled handlers and queue consumers run Worker jobs internally; they are not public HTTP endpoints.

<Note>Source: src/index.js, src/mcp.js, src/free-check.js, src/oauth.js, src/clerk-mcp.js, src/acquisition/browser-route.js and the installed MCP/OAuth transport packages.</Note>