# Agent authentication — CelluloidScore

This document tells software agents how to read the CelluloidScore catalogue.

Everything the catalogue publishes — `/llms.txt`, `/llms-full.txt`, `/geo-chunks/*`,
`/api/v1/manifest.json`, the per-title Markdown fact sheets at `/movies/{slug}.md`
and `/shows/{slug}.md`, and the interactive MCP / A2A tools — is **public**.
Reading needs **no** authentication.

## Interactive endpoints (anonymous)

| Endpoint | Protocol | Access |
| --- | --- | --- |
| `https://celluloidscore.com/api/mcp` | MCP (Streamable HTTP) | Anonymous `catalog:read` |
| `https://celluloidscore.com/api/a2a` | A2A (JSON-RPC) | Anonymous `catalog:read` |

```
POST https://celluloidscore.com/api/mcp
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/list"}
```

Prefer the static bulk files when ingesting the whole catalogue. Use MCP or A2A
for search and filtering.

## Discovery

| Document | Purpose |
| --- | --- |
| [`/.well-known/oauth-protected-resource`](https://celluloidscore.com/.well-known/oauth-protected-resource) | Resource metadata (RFC 9728). `authorization_servers` is empty because the catalogue is public. |
| [`/.well-known/mcp/server-card.json`](https://celluloidscore.com/.well-known/mcp/server-card.json) | MCP server card |
| [`/.well-known/agent-card.json`](https://celluloidscore.com/.well-known/agent-card.json) | A2A agent card |

There is **no** live OAuth authorization server on this host. A discoverable
authorization-server document is not published unless a signing key is
configured and the token endpoints actually issue tokens. Do not treat
`/api/oauth/*` as a working registration flow today — those routes fail closed
without the key.

## Optional Bearer tokens

If a future deployment enables OAuth, a valid `Authorization: Bearer` token
will still be accepted on MCP and A2A. Invalid tokens will then return `401`.
Until that day, a Bearer header is ignored and the request is served
anonymously.

## Rate limits and etiquette

There is no hard quota today. Please keep sustained load below roughly one
request per second, send a descriptive `User-Agent`, and prefer the static bulk
files over per-title calls when ingesting the whole catalogue.