kernelcad

5 of the 45 tools listed anonymously say in their own descriptions that they need an account or a key (review_paint_peek_latest, get_project, get_project_revision, get_latest_render, get_model_mesh), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: review_paint_peek_latest, open_in_studio, get_project, get_project_revision, get_latest_render, get_model_mesh, lookup_authoring_skill, mesh_summary, evaluate_script, diff_scripts, inspect, verify, why_did_this_fail, set_param, add_feature, add_surface, add_curve, add_path_segment, trace_from_image, add_variable_sweep, add_text, project_curve, add_pattern_feature, remove_feature, query, lookup_api, lookup_diagnostics, export, lookup_cookbook, find_part, fetch_part, solve_sketch, add_constraint, add_part, add_connector, add_mate, add_workspace_target, set_scene_return, solve_mates, review_cad, design_loop, flatten_pattern, evaluate_sdf, capture_animation, render_preview.