Immersive Commons

6 of the 183 tools listed anonymously say in their own descriptions that they need an account or a key (ic_admin_list_members, ic_leaderboard_connect_github, ic_leaderboard_set_optin, ic_leaderboard_get_status, ic_admin_leaderboard_inspect, ic_files_get), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: floor10_get_my_floor_member, ic_capabilities, ic_health, floorcast_my_roles, floorcast_effective_features, floorcast_set_feature_enabled, floorcast_set_feature_availability, floorcast_set_ai_policy, floorcast_preview_ai_curation, floorcast_run_ai_curation, floor10_list_my_pending, ic_admin_list_pending_highlights, ic_admin_approve_highlight, ic_admin_reject_highlight, floor10_submit_highlight, floorcast_push, floorcast_unpush, floor10_list_claimable_events, floor10_upload_image, floor10_extract_event_metadata, ic_get_my_membership, ic_request_tier, ic_admin_list_pending_tier_requests, ic_admin_list_members, ic_admin_approve_tier_request, ic_admin_deny_tier_request, ic_admin_list_pending_events, ic_admin_approve_event, ic_admin_reject_event, ic_request_workshop_key, ic_get_my_workshop_key, ic_request_zai_key, ic_get_my_zai_key, ic_get_my_zai_key_usage, ic_admin_list_pending_key_requests, ic_admin_approve_key_request, ic_admin_deny_key_request, ic_membership_set_profile, ic_membership_upload_photo, ic_leaderboard_connect_github, ic_leaderboard_set_optin, ic_leaderboard_get_status, ic_leaderboard_get_board, ic_admin_leaderboard_inspect, ic_events_list_upcoming, ic_events_get, ic_events_get_live, ic_directory_search, ic_resources_list, ic_resources_book, ic_rooms_create, ic_rooms_list, ic_rooms_join, ic_rooms_send, ic_rooms_read, ic_rooms_add_channel, ic_activity_get_recent, ic_context_get, ic_events_rsvp, ic_headsets_list_inventory, ic_headsets_get_unit, ic_headsets_check_waiver, ic_headsets_get_my_lend, ic_headsets_admin_list_active_lends, ic_headsets_admin_list_open_incidents, ic_headsets_sign_waiver, ic_headsets_checkout, ic_headsets_return, ic_headsets_report_damage, ic_headsets_get_attestation_status, ic_headsets_attest_member, ic_headsets_mark_sop_complete, ic_headsets_admin_mark_oos, ic_headsets_admin_clear_oos, ic_headsets_admin_force_return, ic_headsets_admin_resolve_incident, ic_research_ask, ic_research_submit, ic_events_request, ic_files_list, ic_files_get, ic_files_put, ic_files_grant, ic_files_update, ic_transcribe_submit, ic_transcribe_status, ic_transcribe_list, ic_transcribe_get, ic_prints_submit, ic_prints_list, ic_prints_get, ic_prints_cancel, ic_prints_update, ic_token_verify, ic_prints_bed_specs, ic_prints_submit_on_behalf, ic_prints_confirm_handoff, ic_prints_handoff_status, ic_prints_find_by_origin, ic_folders_list, ic_folder_get, ic_folder_create, ic_folder_grant, ic_folder_update, ic_startup_list, ic_startup_request_ownership, ic_signal_list_issues, ic_signal_get_latest, ic_donate, ic_donations_total, ic_signal_get_issue, ic_signal_get_story, ic_signal_search, ic_news_get, ic_presentations_list, ic_presentations_get, ic_feedback_submit, ic_feedback_list_mine, ic_feedback_get_status, ic_admin_list_feedback, ic_admin_resolve_feedback, ic_events_next, ic_agent_inbox_send_envelope, ic_agent_inbox_list_threads, ic_agent_inbox_get_thread, ic_agent_inbox_reply, ic_agent_inbox_undo, ic_agent_inbox_block, ic_agent_inbox_unblock, ic_agent_inbox_list_blocks, ic_agent_policy_get, ic_agent_policy_set, ic_agent_directory_lookup, ic_agent_outbox_list, ic_admin_agent_client_register, ic_admin_agent_client_list, ic_admin_agent_client_revoke, ic_admin_agent_audit_search, ic_startup_update_profile, ic_startup_post_news, ic_admin_list_pending_ownership, ic_admin_approve_ownership, ic_admin_reject_ownership, ic_admin_list_recent_startup_content, ic_admin_takedown_startup_content, ic_hack_get, ic_hack_register, ic_hack_application_form, ic_hack_apply, ic_hack_application_status, ic_hack_withdraw, ic_hack_admin_list_applications, ic_hack_admin_decide_application, ic_hack_sign_nda, ic_hack_me, ic_hack_team_list, ic_hack_team_create, ic_hack_team_join, ic_hack_team_leave, ic_hack_submit, ic_hack_roster, ic_hack_checkin, ic_hack_judge_list, ic_hack_judge_score, ic_hack_bounty_post, ic_hack_admin_role, ic_hack_admin_phase, ic_hack_results, ic_endpoint_register, ic_endpoint_search, ic_endpoint_get, ic_endpoint_set_listed, ic_admin_list_pending_endpoints, ic_admin_approve_endpoint, ic_admin_reject_endpoint, ic_funko_get_mine, ic_funko_get, ic_funko_catalog, ic_funko_progress, ic_funko_set_public, ic_admin_funko_takedown, ic_admin_funko_restore, ic_admin_funko_grant.