Epovest

1 of the 67 tools listed anonymously say in their own descriptions that they need an account or a key (list_surfaces), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: list_trackers, create_tracker, update_tracker, start_tracker, survey_now, pause_tracker, archive_tracker, list_projects, create_project, rename_project, get_canon, update_project_canon, get_link_targets, set_link_targets, archive_project, list_surfaces, create_surface, update_surface, tick_surface_checklist, add_surface_check, update_surface_check, delete_surface_check, restore_surface_check, delete_surface, restore_surface, convert_surface_to_corroboration, list_corroborations, create_corroboration, update_corroboration, archive_corroboration, verify_corroboration, convert_corroboration_to_surface, list_corroboration_candidates, dismiss_corroboration_candidate, get_logbook, create_logbook_entry, update_logbook_entry, delete_logbook_entry, restore_logbook_entry, list_quests, create_quest, update_quest, complete_quest, dismiss_quest, reopen_quest, get_results, get_responses, list_keyword_discoveries, accept_keyword_discovery, dismiss_keyword_discovery, restore_keyword_discovery, list_competitor_scans, get_competitor_scan, create_competitor_scan, start_competitor_scan, update_competitor_scan, list_sources, get_source, list_source_channels, get_account_settings, update_account_settings, get_credits, get_usage, topup_credits, contact_support, list_support_threads, get_support_thread.