generated: '2026-09-12'
method: probed
source: >-
  https://shop.agnikul.in/.well-known/openid-configuration (200),
  https://shop.agnikul.in/.well-known/oauth-protected-resource (200), anonymous MCP initialize and
  tools/list against https://shop.agnikul.in/api/ucp/mcp (200), and
  https://shop.agnikul.in/agents.md (200)
name: Agnikul authentication profile
slug: agnikul

summary: >-
  Agnikul publishes no API keys and runs no developer key-issuance program on any host. Its one
  programmable surface — the Cosmos Store commerce MCP endpoint — is anonymous: initialize,
  tools/list, catalog search, product lookup, cart and checkout creation all succeed with no
  credential. Authorization moves to the payment step rather than the transport step: completing a
  checkout requires a buyer-approved payment instrument and an idempotency key. A separate OAuth 2.0
  / OpenID Connect authorization server exists for store customer accounts. The launch-services
  business at agnikul.in has no authenticated surface at all — no login, no portal, no account system.

schemes:
- id: none
  surface: Agnikul Cosmos Store Commerce MCP API
  endpoint: https://shop.agnikul.in/api/ucp/mcp
  type: none
  verified: probed
  evidence:
    request: 'POST tools/list with no Authorization header'
    http_status: 200
    result: 13 tools returned with full inputSchemas
  note: >-
    No API key, bearer token or client credential is required or accepted for tool discovery or for
    catalog, cart and checkout operations.

- id: ucp-agent-profile
  surface: Agnikul Cosmos Store Commerce MCP API
  type: agent-identity
  required: true
  location: request body — meta.ucp-agent
  format: object carrying the agent's UCP profile URI
  verified: probed
  note: >-
    Not authentication in the credential sense, but a required identity input on all 13 tools: every
    inputSchema lists meta as required and meta.required includes "ucp-agent". The server identifies
    the calling agent, not the user.

- id: payment-instrument
  surface: Agnikul Cosmos Store Commerce MCP API — complete_checkout
  type: buyer-authorization
  required: true
  location: request body — checkout payment instruments
  verified: probed
  handlers:
  - id: gpay
    handler: com.google.pay
    version: '2026-01-11'
    merchant_name: Cosmos Store
    merchant_id: '16708973830884969730'
    merchant_origin: shop.agnikul.in
    gateway: shopify
    gateway_merchant_id: '85860712758'
    card_networks: [VISA, MASTERCARD, AMEX, DISCOVER]
    auth_methods: [PAN_ONLY, CRYPTOGRAM_3DS]
    billing_address_required: true
  - id: shopify.card
    handler: dev.shopify.card
    version: '2026-01-15'
    card_brands: [visa, master, american_express, discover, diners_club]
  shop_pay_absent: true
  shop_pay_note: >-
    Unlike most Shopify UCP merchants, this store's profile declares only two payment handlers —
    dev.shopify.shop_pay is NOT advertised — while the store's own agents.md tells agents to route
    through Shop Pay when they cannot get contemporaneous buyer approval. The advice and the declared
    handler set disagree.
  note: >-
    The store's robots.txt and agents.md both state the rule explicitly: "Checkouts are for humans.
    Do NOT complete checkout, payment, or order placement automatically ... without an explicit,
    contemporaneous human approval step."

- id: shopify-customer-account-oauth
  surface: Cosmos Store customer accounts (order history, saved addresses)
  type: oauth2
  subtype: openIdConnect
  verified: probed
  issuer: https://shopify.com/authentication/85860712758
  discovery: https://shop.agnikul.in/.well-known/openid-configuration
  authorization_endpoint: https://shopify.com/authentication/85860712758/oauth/authorize
  token_endpoint: https://shopify.com/authentication/85860712758/oauth/token
  end_session_endpoint: https://shopify.com/authentication/85860712758/logout
  jwks_uri: https://shopify.com/authentication/85860712758/.well-known/jwks.json
  response_types: [code]
  pkce: ['S256']
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post]
  id_token_signing_algs: [RS256]
  subject_types: [public]
  claims: [iss, sub, aud, exp, iat, nonce, sid, email, email_verified]
  scopes_file: scopes/agnikul-scopes.yml
  note: >-
    Platform-operated (Shopify customer accounts) and, unlike some merchants, NOT re-hosted on an
    Agnikul subdomain — every endpoint points straight at shopify.com. Client registration is not
    publicly documented by Agnikul; there is no self-service developer console on any Agnikul host.

protected_resource:
  source: https://shop.agnikul.in/.well-known/oauth-protected-resource
  resource: https://shop.agnikul.in
  authorization_servers:
  - https://shopify.com/authentication/85860712758
  bearer_methods_supported: [header]
  rfc: RFC 9728

launch_services_surface:
  host: agnikul.in
  authenticated_surface: none
  probed:
  - url: https://agnikul.in/.well-known/openid-configuration
    http_status: 404
  - url: https://agnikul.in/.well-known/oauth-authorization-server
    http_status: 404
  note: >-
    No customer portal, no mission dashboard, no login of any kind. Launch enquiries are a public
    HTML form at https://agnikul.in/book/ that routes to payloadpeople@agnikul.in.

gaps:
- No security.txt and no published vulnerability-disclosure contact on any Agnikul host.
- No developer portal, no API key issuance, no documented client registration for the OAuth server.
- >-
  The store recommends Shop Pay as the fallback for agents that cannot obtain contemporaneous buyer
  approval, but does not advertise the dev.shopify.shop_pay handler in its UCP profile.