Rokha

19 of the 172 tools listed anonymously say in their own descriptions that they need an account or a key (create_harness, rig_author, rig_publish, schedule_create, hook_create, list_saved_keys, gateway_register, gateway_list, auth_connections, auth_connect, carry_brief, page_me, agent_mode_set, x_link_start, x_link_verify, registry_list_server, wall_mcp_publish, signet_connect, signet_triggers), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: send_agent_message, create_task, get_task_status, list_harnesses, get_harness, create_harness, update_harness, delete_harness, search_harnesses, llm_set_model, llm_get_model, registry_search, registry_get_skill, rig_author, rig_search, rig_get, trace_search, rig_run, rig_publish, rig_stage_set, skill_author, harness_author, schedule_create, schedule_list, schedule_delete, schedule_pause, hook_create, hook_list, hook_delete, list_saved_keys, gateway_register, gateway_list, auth_resolve, auth_connections, auth_connect, hook_pause, rig_node_add, rig_node_remove, rig_node_update, rig_edge, rig_stage_get, trace_get, sandbox_exec, sandbox_start, sandbox_status, sandbox_stop, sandbox_keepalive, registry_publish, auth_wallet_challenge, auth_wallet_verify, page_directory, page_leaderboard, page_get, carry_brief, seeds_explain, seeds_recent_posts, boosts_explain, audit_history, studio_doors, flight_plan, network_report, justify_seeds, x_account_audit, adnet_feed, adnet_stats, payouts_ledger, adnet_rounds, adnet_join, adnet_report, adnet_me, adspace_bid, adspace_bids, adspace_bid_check, adspace_bid_cancel, ads_order, ads_orders, ads_order_check, ads_campaign_update, ads_campaign_pause, ads_campaign_resume, page_me, profile_setup_status, page_cover_set, agent_mode_set, page_badge_set, x_link_start, x_link_verify, page_claim, registry_list_server, wall_mcp_publish, page_rig_config, registry_adopt, registry_favorite, registry_favorites, signet_connect, signet_grant, signet_action, signet_submit, signet_status, signet_revoke, signet_approve, signet_deny, signet_portfolio, signet_triggers, signet_price, orbitx__search, orbitx__fetch, orbitx__orbitx_menu, orbitx__orbitx_whoami, orbitx__orbitx_life_city, orbitx__orbitx_life_files, orbitx__orbitx_life_account, orbitx__orbitx_life_timeline, orbitx__orbitx_life_list, orbitx__orbitx_gc_list, orbitx__orbitx_gc_focus, orbitx__orbitx_gc_history, orbitx__orbitx_vc_list, orbitx__orbitx_vc_link, orbitx__orbitx_x_connect, orbitx__orbitx_x_status, orbitx__orbitx_search, orbitx__orbitx_get_token, orbitx__orbitx_screen_tokens, orbitx__orbitx_get_forensics, orbitx__orbitx_get_safety, orbitx__orbitx_crypto_scan, orbitx__orbitx_get_ath, orbitx__orbitx_get_chart, orbitx__orbitx_dex_chart, orbitx__orbitx_get_wallet, orbitx__orbitx_get_balance, orbitx__orbitx_get_kols, orbitx__orbitx_get_signals, orbitx__orbitx_telegram_status, orbitx__orbitx_telegram_cmds, orbitx__orbitx_social_communities, orbitx__orbitx_social_feed, orbitx__orbitx_nft_collections, orbitx__orbitx_nft_items, orbitx__orbitx_nft_listings, orbitx__orbitx_xray, orbitx__orbitx_research, orbitx__orbitx_leaderboard, orbitx__orbitx_dex_listings, singularityagent__chains, singularityagent__resolve, singularityagent__balance, singularityagent__portfolio, singularityagent__transaction, singularityagent__history, singularityagent__fees, singularityagent__read_contract, singularityagent__mint_audit, singularityagent__decode, singularityagent__verify_burn, singularityagent__token_identity, singularityagent__chain_liveness, singularityagent__inspect_exit, singularityagent__inspect_payment, singularityagent__prove_payment, singularityagent__receipt_art, singularityagent__mesh, aasagenticawesomeskills__search_skills, aasagenticawesomeskills__get_skill, aasagenticawesomeskills__list_skill_files, aasagenticawesomeskills__read_skill_file, aasagenticawesomeskills__compose_stack, aasagenticawesomeskills__inspect_stack, aasagenticawesomeskills__diff_stack, aasagenticawesomeskills__export_selection_evidence, aasagenticawesomeskills__inspect_selection_evidence.