# auth.md

Agent registration and authentication guide for **Moltline Studio** (moltlinestudio.com) and its MCP server fleet at `mcp.moltlinestudio.com`.

## Audience

This document is for AI agents, MCP clients, and automated integrators that want to register for and use Moltline Studio's 14 hosted MCP servers (catalog, codereview, timeops, data, business, creator, educator, govern, humanizer, merchant, outbound, personal, research, skillmd-lint). Moltline Studio publishes OAuth 2.0 discovery metadata (see `/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource`), but interactive OAuth flows are not offered; this file is the source of truth for agent registration and access.

## Agent registration

Agents register and obtain access as follows:

- **Registration endpoint:** https://moltlinestudio.com/ (human-in-the-loop provisioning; agents must not attempt automated registration or purchase)
- **Registration methods supported:**
  1. **`anonymous`** — no registration required. Any agent may connect immediately to the free tier. No account is created and no credential is issued.
  2. **`license`** — an agent's human operator registers by completing a one-time purchase at the registration endpoint above. A Moltline license is then issued to the buyer by email, which unlocks premium tools.

### Registration flow: `anonymous` (complete, standalone)

1. Choose a server from the catalog at `https://moltlinestudio.com/.well-known/api-catalog`.
2. Connect your MCP client to `https://mcp.moltlinestudio.com/<server>` over Streamable HTTP. No registration, account, or credential is required.
3. Call `tools/list` and start using the free tools immediately. Done — there is no step 4.

### Registration flow: `license` (complete, standalone)

1. The agent surfaces the registration endpoint `https://moltlinestudio.com/` to its human operator.
2. The operator completes the one-time All-Access purchase (USD 19.00/month) at that endpoint — by card checkout or crypto via NOWPayments, or agent-natively via the x402 challenge at `https://moltlinestudio.com/api`.
3. The license credential (a signed `MOLT-` key) is delivered to the buyer's email within minutes of payment confirmation.
4. The agent presents the license as a tool argument wherever a premium tool requires it. Validation is fully server-side; the credential is never sent as a bearer header and never placed in URLs.
5. To revoke, the operator simply cancels the subscription — the key expires at period end. Support: support@moltlinestudio.com.

Machine-readable registration metadata (also published in `/.well-known/oauth-authorization-server`):

```json
{
  "agent_auth": {
    "skill": "https://moltlinestudio.com/auth.md",
    "register_uri": "https://moltlinestudio.com/",
    "claim_uri": "https://moltlinestudio.com/",
    "identity_types_supported": ["anonymous"],
    "anonymous": {
      "credential_types_supported": ["license_key"],
      "claim_uri": "https://moltlinestudio.com/"
    }
  }
}
```

## Access tiers

### 1. Anonymous access (free tier)

No registration, no account, no credentials. Connect any MCP client directly to a server endpoint over Streamable HTTP:

```
https://mcp.moltlinestudio.com/<server>
```

Example: `https://mcp.moltlinestudio.com/timeops`. All free tools work immediately. Server capabilities are machine-discoverable via each server's card at `https://mcp.moltlinestudio.com/<server>/.well-known/mcp/server-card.json` and the catalog at `https://moltlinestudio.com/.well-known/api-catalog`.

### 2. Licensed access (premium tier)

Premium capabilities are unlocked with the Moltline license obtained through registration method `license` above.

## Credential use

- The license is presented as a **tool argument** where a premium tool requires it. It is never sent as a bearer header and never embedded in URLs.
- Licenses are non-transferable, bound to the purchaser, and cannot be shared, resold, or rented.
- Validation happens entirely server-side; no secret material is ever exposed to clients.
- If a premium tool reports that a license is required, the agent should surface the registration endpoint above to its human operator.

## Health and status

- Fleet health: `https://mcp.moltlinestudio.com/health` (JSON, reports mounted/failed server counts)
- Independent audits: MCPize Verified A on direct endpoints — see listing pages on mcpize.com

## Contact

Publisher: Moltline Studio · GitHub: https://github.com/GarphenGate · Community: https://community.moltlinestudio.com