audit

5 of the 40 tools listed anonymously say in their own descriptions that they need an account or a key (create_sulvo_signup_account, create_sulvo_ad_unit, delete_sulvo_ad_unit, get_sulvo_report, list_sulvo_advanced_reports), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: check_https_certificate, run_agentic_readiness_audit, check_crawler_blocks, start_sulvo_revenue_onboarding, get_sulvo_revenue_onboarding_status, attach_sulvo_revenue_audit, connect_sulvo_backup_provider, import_sulvo_backup_units, review_sulvo_placement_recommendations, save_sulvo_placement_plan, map_sulvo_placement_backup, get_sulvo_installation_instructions, verify_sulvo_placement_installation, lock_sulvo_placement_revision, run_sulvo_activation_preflight, verify_sulvo_site_ownership, submit_sulvo_activation_workspace, submit_sulvo_site_for_approval, set_sulvo_onboarding_journey, rollback_sulvo_activation, get_sulvo_activation_smoke_status, run_publisher_revenue_audit, apply_for_sulvo_account, start_sulvo_signup, create_sulvo_signup_account, update_sulvo_signup_company, get_sulvo_signup_ads_txt, verify_sulvo_signup_ads_txt, get_sulvo_signup_status, submit_sulvo_signup_documents, get_publisher_revenue_audit_checklist, get_publisher_monetization_benchmarks, create_sulvo_ad_unit, create_sulvo_interstitial_units, create_sulvo_auto_sticky_units, delete_sulvo_ad_unit, get_sulvo_report, list_sulvo_advanced_reports, save_sulvo_advanced_report, delete_sulvo_advanced_report.