Zernio

2 of the 52 tools listed anonymously say in their own descriptions that they need an account or a key (profiles_delete, usage_get_usage), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: zernio_overview, accounts_list, accounts_get, profiles_list, profiles_get, profiles_create, profiles_update, profiles_delete, posts_list, posts_get, posts_create, posts_publish_now, posts_cross_post, posts_update, posts_delete, posts_retry, posts_list_failed, posts_retry_all_failed, media_generate_upload_link, media_check_upload_status, docs_search, account_groups_list_account_groups, accounts_get_follower_stats, accounts_move_account_to_profile, accounts_get_all_accounts_health, accounts_get_account_health, analytics_get_analytics, analytics_get_daily_metrics, analytics_get_best_time_to_post, analytics_get_post_timeline, comments_list_inbox_comments, comments_get_inbox_post_comments, comments_reply_to_inbox_post, mentions_list_inbox_mentions, mentions_reply_to_mention, posts_bulk_upload_posts, posts_unpublish_post, posts_edit_post, queue_list_queue_slots, queue_create_queue_slot, queue_update_queue_slot, queue_delete_queue_slot, queue_preview_queue, queue_get_next_queue_slot, tracking_tags_list_tracking_tags, tracking_tags_get_tracking_tag_stats, usage_get_usage, validate_post_length, validate_post, validate_media, search_tools, call_tool.