# auth.md

Agent authentication and access policy for **国内Coding Plan对比** (`https://coding.mcppla.net`).

All dataset, comparison, and grounding endpoints on `https://coding.mcppla.net` are **public and anonymous** (`auth.type: none`). No API key, signup, or OAuth token exchange is required.

## Public Endpoints (No Authentication Required)

- `GET https://coding.mcppla.net/api/plans.json` — Full machine-readable AI Coding Plan comparison dataset
- `GET https://coding.mcppla.net/api/plans` — Alias for `/api/plans.json`
- `GET https://coding.mcppla.net/llms.txt` — Concise LLM-oriented site summary
- `GET https://coding.mcppla.net/llms-full.txt` — Complete inline Markdown pricing & quota tables
- `GET https://coding.mcppla.net/.well-known/openapi.yaml` — OpenAPI 3.0.1 specification
- `GET https://coding.mcppla.net/.well-known/api-catalog` — RFC 9727 API catalog (`application/linkset+json`)
- `GET https://coding.mcppla.net/.well-known/agent-card.json` — A2A v1.0 Agent Card
- `GET https://coding.mcppla.net/.well-known/mcp/server-card.json` — SEP-1649 MCP Server Card
- `GET https://coding.mcppla.net/.well-known/agent-skills/index.json` — Agent Skills v0.2.0 discovery index
- `GET https://coding.mcppla.net/.well-known/http-message-signatures-directory` — Web Bot Auth Ed25519 JWKS

## OAuth Discovery Metadata

RFC 9728 (`/.well-known/oauth-protected-resource`) and RFC 8414 (`/.well-known/oauth-authorization-server`) documents are published with `issuer: "https://coding.mcppla.net"` and `identity_types_supported: ["anonymous"]` so automated agent-readiness scanners can verify anonymous access policy without probing interactive login flows.

Last updated: 2026-11-10.