Riddle

5 of the 62 tools listed anonymously say in their own descriptions that they need an account or a key (riddle_delete, riddle_move, riddle_builder_placeholder, reference_get, stats_user_breakdown), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: riddleTemplate_create, riddleTemplate_list, riddleTemplate_publicList, riddleTemplate_get, riddleTemplate_use, riddle_tag_list, riddle_tag_add, riddle_tag_remove, riddle_tag_delete, ping, riddle_list, riddle_account_list, riddle_get, riddle_get_embed_code, riddle_publish, riddle_unpublish, riddle_rename, riddle_delete, riddle_move, riddle_move_check, whoami, questionBank_create, questionBank_list, questionBank_templateList, questionBank_get, questionBank_rename, questionBank_updateNotes, questionBank_duplicate, questionBank_publish, questionBank_discardChanges, questionBank_delete, questionBank_addItem, questionBank_updateItem, questionBank_deleteItem, questionBank_getItems, questionBank_tagList, questionBank_addTag, questionBank_removeTag, questionBank_blockTypeColumns, questionBank_riddleBlockItems, palette_get, palette_customize, riddle_builder_quiz, riddle_builder_poll, riddle_builder_personality, riddle_builder_form, riddle_builder_predictor, riddle_builder_leaderboard, riddle_builder_minigame, riddle_builder_story, riddle_builder_placeholder, riddle_builder_update, riddle_builder_validate, reference_get, stats_fetch, stats_overview_fetch, stats_riddle_breakdown, stats_user_breakdown, stats_project_breakdown, project_list, project_get, project_get_settings.