# NeoFast auth.md

You are an agent. This service (https://neofastapp.com/) is a public medical content site: the NeoFast neonatal clinical library, free calculators and a read-only API. It follows the auth.md layout (discover, pick a method, register, obtain credentials, call, handle revocation) so you can decide quickly. The short version: **everything is anonymous, there is nothing to register**.

## Step 1: Discover

- There is no `/.well-known/oauth-protected-resource` and no `/.well-known/oauth-authorization-server`: this site has no OAuth authorization server and no protected API for agents. Those documents are absent on purpose; do not retry them.
- What exists: `/.well-known/ai-catalog.json` (ARD manifest), `/.well-known/agent-skills/index.json` (skills), `/.well-known/api-catalog` (RFC 9727), `/llms.txt`, `/robots.txt` with `Content-Signal`.

## Step 2: Pick a method

- `identity_types_supported`: `["anonymous"]` only. `identity_assertion` (ID-JAG) and `service_auth` (verified email) are not supported.
- Anonymous access needs no claim ceremony and no user consent gate, because no user identity is asserted to the service.

## Step 3: Register

Registration is not required and not available: there is no `identity_endpoint`, no `claim_endpoint`, no registration form and no API key issuance. Skip this step.

## Step 4: Credentials

- `credential_types_supported`: none. Do not send an `Authorization` header; requests are plain HTTP GET.
- Public read API: WordPress REST at https://neofastapp.com/wp-json/ (routes and schemas in its index). Write endpoints exist but require a WordPress account with an Application Password, provisioned manually by the site owner and not open to agents.

- MCP server (read-only, anonymous): POST https://neofastapp.com/mcp; how to connect: https://neofastapp.com/mcp-server/; card at /.well-known/mcp/server-card.json.
## Step 5: Call the service

- Any page: `GET <url>` with `Accept: text/markdown` returns Markdown; without it you get HTML.
- Search: `GET https://neofastapp.com/wp-json/wp/v2/posts?search=<terms>&lang=<en|pt|es|fr|de|ru|zh|hi|ar>&_fields=id,link,title,excerpt`
- Rate: a few requests per second is fine; responses are cacheable.

## Step 6: Revocation

Not applicable: no credentials are issued, so none can be revoked. Access policy is expressed in `/robots.txt` (`Content-Signal: ai-train=yes, search=yes, ai-input=yes`).

## Contact

Site owner: https://neofastapp.com/pt/contato/