# Authentication

## Current status

The Wachter Intelligence MCP server at `https://wachter.ai/mcp` requires no API key, OAuth token, account, or cookie. It exposes only public, read-only workflow guidance and canonical company information. It cannot send a contact message, create or change a booking, access private customer data, or perform an operational automation.

## Connection

Use the MCP Streamable HTTP transport and send JSON-RPC 2.0 requests with `POST https://wachter.ai/mcp`. Supported protocol versions are `2026-07-28`, `2025-11-25`, and `2025-06-18`. The server card is available at `https://wachter.ai/.well-known/mcp/server-card.json`.

## Permissions and scopes

There are no scopes because there are no authenticated or state-changing operations. Every tool declares `readOnlyHint: true`, `destructiveHint: false`, and `idempotentHint: true`. Resources contain the same public information available on the website.

## User approval boundary

An agent may use the tools to prepare guidance or retrieve public information without asking for credentials. Before sending an email, submitting a contact form, or booking a meeting through a separate user-facing channel, the agent must obtain explicit user approval. The MCP server itself provides no method that performs those actions.

## Example initialization

Send an `initialize` request, then a `notifications/initialized` notification. Clients can discover capabilities with `tools/list` and `resources/list`. Invalid JSON-RPC requests receive typed error objects with stable numeric codes and a resolution hint where useful.