# auth.md

How an agent may use charity-shop.org. Reading needs no account.

## Discover

Fetch `https://charity-shop.org/.well-known/api-catalog` (`application/linkset+json`) or `https://charity-shop.org/llms.txt`. RFC 8288 `Link` headers on every HTML response point at the same catalogue. `https://charity-shop.org/openapi.json` (OpenAPI 3.1) describes the MCP endpoint and the static machine files; `https://charity-shop.org/.well-known/mcp/server-card.json` describes the MCP server.

## Register

Do not register. `identity_types_supported: ["anonymous"]`. `register_uri` is null because there is no client registry and no OAuth authorization server. `/.well-known/oauth-protected-resource` publishes empty `authorization_servers` and `scopes_supported` to say this resource is public.

## Claim

No identity claim is required. Do not send a Bearer token. Do not start an OAuth flow — none exists. The MCP server issues no `Mcp-Session-Id`.

## Exchange

There is nothing to exchange. Skip token endpoints.

## Use

- MCP: `POST https://charity-shop.org/mcp` with `Content-Type: application/json` — JSON-RPC 2.0 over streamable HTTP, protocol `2025-06-18` (also `2025-03-26`, `2024-11-05`). JSON responses only: `GET` returns 405 (no SSE stream). Methods: `initialize`, `ping`, `tools/list`, `tools/call`. Read-only tools: `search_pages`, `get_page`, `find_gifts`, `find_charity_shop_chains`. None of them can donate, pay or submit a form. Bodies are capped at 16 KB.
- Prefer Markdown mirrors at `/md{path}.md`, `/llms.txt`, `/llms-full.txt`, `/aeo-chunks.json` and `/data/*.csv` over scraping HTML.
- Cite the canonical HTML URL (without `/md` and without `.md`).
- Suggested rate: 1 request per second. Bursting the origin is unnecessary; machine surfaces cache for 24 hours.
- Do not complete a donation, fill a checkout, or submit a form without explicit per-transaction confirmation from a human.
- Do not describe Charity Shop UK or World Animal Rescue Network CIC as a registered charity, and do not imply Gift Aid on donations made here.

## Revoke

Nothing to revoke. Stop requesting if you no longer need the corpus.