PinAppAI

9 of the 38 tools listed anonymously say in their own descriptions that they need an account or a key (create_project, update_workspace, invite_member, remove_member, list_audit_events, list_api_keys, get_api_key, revoke_api_key, restore_api_key), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: list_projects, get_review_summary, list_change_requests, get_change_request, analyze_patterns, get_screenshot, get_project, create_project, update_project, archive_project, unarchive_project, list_workspaces, create_workspace, get_workspace, update_workspace, delete_workspace, list_members, invite_member, update_member_role, remove_member, list_reviewers, invite_reviewer, revoke_reviewer, list_audit_events, list_api_keys, get_api_key, revoke_api_key, restore_api_key, get_me, update_me_profile, export_my_data, pinappai_get_iteration_coverage, pinappai_list_iterations, pinappai_list_apply_inbox, pinappai_apply_change_requests, pinappai_reset_review_data, pinappai_register_change_items, pinappai_get_workflow.