Dock

4 of the 69 tools listed anonymously say in their own descriptions that they need an account or a key (update_workspace, request_revoke_agent_key, request_rotate_agent_key, share_file), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

The server exposes a public surface before authorization: list_workspaces, get_workspace, list_rows, create_row, get_row, update_row, delete_row, move_rows, get_doc, get_workspace_schema, add_column, list_workspace_members, delete_workspace, update_workspace, share_workspace, update_workspace_member, remove_workspace_member, update_doc, validate_doc_markdown, update_doc_section, append_doc_section, get_html, update_html, validate_html, create_workspace, get_recent_events, search, get_billing, upgrade_plan, downgrade_plan, request_limit_increase, list_surfaces, create_surface, update_surface, delete_surface, list_api_keys, rotate_api_key, revoke_api_key, request_revoke_agent_key, request_rotate_agent_key, list_webhooks, create_webhook, update_webhook, rotate_webhook_secret, delete_webhook, send_message, create_support_ticket, list_support_tickets, get_support_ticket, list_sheet_functions, validate_formula, evaluate_formula, add_comment, list_comments, get_comment_thread, reply_to_comment, resolve_comment, unresolve_comment, react_to_comment, list_files, get_file, delete_file, share_file, revoke_file_share, list_recent_files, address_book, list_capabilities, pull_capability, request_connection.