Name Whisper — ENS Intelligence Layer

2 of the 44 tools listed anonymously say in their own descriptions that they need an account or a key (create_listing, get_caller_identity), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: search_ens_names, enumerate_entities, get_name_details, check_availability, get_similar_names, get_valuation, get_market_activity, get_expiring_names, wash_check, get_wallet_portfolio, find_alpha, get_primary_name, provision_agent_identity, make_offer, purchase_name, bulk_register, create_listing, cancel_listing, cancel_offer, accept_offer, batch_purchase, sweep, batch_create_listings, renew_ens_name, transfer_ens_name, set_ens_records, bulk_set_records, bulk_transfer_ens_names, set_primary_name, set_resolver, manage_ens_name, wrap_name, unwrap_name, manage_fuses, mint_subnames, extend_subname_expiry, approve_operator, reclaim_name, register_agent, get_agent_reputation, search_agent_directory, get_caller_identity, search_knowledge, get_usage_stats.