# auth.md — Authentication & Access Policy (RingSide Telemetry)

All human and machine-readable surfaces on `https://ragdoll-robot-boxing.pages.dev` are **100% public, read-only, and unauthenticated**.

## Machine Endpoints & Authentication Mode

- **REST API (`/api/lookup`, `/api/codes.json`, `/api/badges.json`, `/api/health.json`)**: `auth: none`. No API key, Bearer token, or cookie is required.
- **Model Context Protocol (`POST /mcp`)**: `auth: none`. Accepts anonymous JSON-RPC 2.0 `initialize`, `tools/list`, and `tools/call` requests over HTTPS.
- **Agent Skills (`/.well-known/agent-skills/index.json`)**: `auth: none`. Artifacts are verified via `sha256` content digests.
- **Browser Interactive Tools**: State is persisted exclusively in client-side `window.localStorage` (`rrb_codes_v1`, `rrb_badges_v1`, `rrb_grind_v1`). No user accounts or server sessions exist.