ThinkNEO Control Plane

36 of the 68 tools listed anonymously say in their own descriptions that they need an account or a key (thinkneo_write_memory, thinkneo_evaluate_guardrail, thinkneo_check, thinkneo_provider_status, thinkneo_schedule_demo, thinkneo_route_model, thinkneo_get_savings_report, thinkneo_simulate_savings, thinkneo_evaluate_trust_score, thinkneo_get_trust_badge, thinkneo_registry_search, thinkneo_registry_get, thinkneo_registry_publish, thinkneo_registry_review, thinkneo_registry_install, thinkneo_start_trace, thinkneo_log_event, thinkneo_end_trace, thinkneo_get_trace, thinkneo_get_observability_dashboard, thinkneo_register_claim, thinkneo_verify_claim, thinkneo_get_proof, thinkneo_verification_dashboard, thinkneo_benchmark_report, thinkneo_benchmark_compare, thinkneo_router_explain, thinkneo_sla_define, thinkneo_sla_status, thinkneo_sla_breaches, thinkneo_sla_dashboard, thinkneo_check_pii_international, thinkneo_alert_rule_list, thinkneo_alert_rule_create, thinkneo_alert_rule_delete, thinkneo_alert_rule_test), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: thinkneo_check_spend, thinkneo_complete, thinkneo_read_memory, thinkneo_write_memory, thinkneo_evaluate_guardrail, thinkneo_check, thinkneo_check_policy, thinkneo_get_budget_status, thinkneo_list_alerts, thinkneo_get_compliance_status, thinkneo_provider_status, thinkneo_schedule_demo, thinkneo_usage, thinkneo_route_model, thinkneo_get_savings_report, thinkneo_simulate_savings, thinkneo_evaluate_trust_score, thinkneo_get_trust_badge, thinkneo_registry_search, thinkneo_registry_get, thinkneo_registry_publish, thinkneo_registry_review, thinkneo_registry_install, thinkneo_bridge_mcp_to_a2a, thinkneo_bridge_a2a_to_mcp, thinkneo_bridge_generate_agent_card, thinkneo_bridge_list_mappings, thinkneo_start_trace, thinkneo_log_event, thinkneo_end_trace, thinkneo_get_trace, thinkneo_get_observability_dashboard, thinkneo_set_baseline, thinkneo_log_decision, thinkneo_log_risk_avoidance, thinkneo_decision_cost, thinkneo_agent_roi, thinkneo_business_impact, thinkneo_a2a_log, thinkneo_a2a_policy, thinkneo_a2a_flow, thinkneo_a2a_audit, thinkneo_detect_waste, thinkneo_register_claim, thinkneo_verify_claim, thinkneo_get_proof, thinkneo_verification_dashboard, thinkneo_benchmark_report, thinkneo_benchmark_compare, thinkneo_router_explain, thinkneo_compliance_generate, thinkneo_sla_define, thinkneo_sla_status, thinkneo_sla_breaches, thinkneo_sla_dashboard, thinkneo_audit_export, thinkneo_compare_models, thinkneo_count_tokens, thinkneo_optimize_prompt, thinkneo_rotate_key, thinkneo_manage_secrets, thinkneo_cache_status, thinkneo_detect_injection, thinkneo_check_pii_international, thinkneo_alert_rule_list, thinkneo_alert_rule_create, thinkneo_alert_rule_delete, thinkneo_alert_rule_test.