BorealHost

137 of the 144 tools listed anonymously say in their own descriptions that they need an account or a key (whoami, complete_checkout, get_checkout_status, get_site_status, manage_dns, install_app, get_app_status, list_apps, list_snapshots, create_snapshot, create_b2_snapshot, delete_snapshot, rollback_snapshot, get_snapshot_usage, schedule_snapshot, cancel_scheduled_snapshot, list_backups, create_backup, restore_backup, get_metrics, scale, decommission, update_account, delete_account, list_subscriptions, get_billing_portal, rotate_key, create_api_key, list_api_keys, revoke_api_key, get_ssh_info, add_ssh_key, list_files, read_file, write_file, upload_file, delete_file, create_directory, list_plugins, list_themes, manage_plugin, manage_theme, wp_check_updates, wp_update_all, list_cron, add_cron, delete_cron, ssl_info, ssl_renew, list_php_versions, switch_php, cache_status, cache_flush, cache_toggle, get_database_info, optimize_database, database_search_replace, list_databases, list_tables, execute_query, get_stack_info, get_resource_snapshot, cloudflare_proxy_status, cloudflare_set_proxy, cloudflare_purge_cache, list_ftp_accounts, create_ftp_account, remove_ftp_account, list_alert_rules, create_alert_rule, delete_alert_rule, run_malware_scan, list_firewall_rules, add_firewall_rule, remove_firewall_rule, get_logs, list_domains, search_domain, register_domain, domain_detail, list_subdomains, add_subdomain, link_domain, set_domain_usage, domain_settings, list_domain_dns, add_domain_dns, delete_domain_dns, list_modules, toggle_module, list_compute_types, list_compute_images, launch_compute_instance, list_compute_instances, get_compute_instance, start_compute_instance, stop_compute_instance, reboot_compute_instance, terminate_compute_instance, list_compute_volumes, get_compute_volume, create_compute_volume, adopt_compute_instance, detach_compute_volume, attach_compute_volume, snapshot_compute_volume, delete_compute_volume, container_action, list_support_tickets, get_support_ticket, create_support_ticket, reply_support_ticket, get_backup_retention, set_backup_retention, delete_backup, list_redirects, add_redirect, delete_redirect, set_force_https, list_db_users, manage_db_user, transfer_out_domain, enable_wildcard, upload_ssl_cert, get_email_status, setup_email, create_mailbox, delete_mailbox, reset_mailbox_password, get_webmail_url, list_webhooks, create_webhook, delete_webhook, test_webhook, get_smtp_relay, enable_smtp_relay, revoke_smtp_relay), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.