agentee

1 of the 31 tools listed anonymously say in their own descriptions that they need an account or a key (studio_generate), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: search_products, get_product, list_collections, view_cart, add_to_cart, set_cart_quantity, checkout_link, order_status, cart_update, cart_remove, apply_promo, remove_promo, get_user_prefs, set_user_prefs, get_saved_addresses, set_shipping_address, get_shipping_options, set_shipping_method, get_order_preview, prepare_order, studio_options, studio_generate, studio_status, studio_credits, add_custom_to_cart, designer_stats, designer_designs, designer_upload_slot, submit_design, designer_uploads, designer_submissions.