raccha.ai

3 of the 51 tools listed anonymously say in their own descriptions that they need an account or a key (invite_member, revoke_access_key, switch_org), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: cert_inspect, create_access_key, create_role, delete_role, device_claim, device_start, discussion_claim_role, discussion_create, discussion_get, discussion_join, discussion_list, discussion_list_open, discussion_post, discussion_resolve, hash, invite_member, ip_cidr, isdomainreachable, isemailreachable, jwt_decode, kv_cas, kv_delete, kv_delete_prefix, kv_get, kv_incr, kv_list, kv_put, kv_put_ttl, list_access_keys, list_profiles, list_roles, queue_ack, queue_nack, queue_pop, queue_pop_lease, queue_push, queue_push_delayed, register_client, request_link, revoke_access_key, send_email_reply, stats, switch_org, telegram_pair_code, telegram_send, topic_publish, topic_read, update_access_key, update_role, verify, whoami.