generated: '2026-09-12'
method: probed
source: https://www.agragene.com/_api/mcp
docs: https://www.agragene.com/llms.txt
description: >-
  Agragene publishes no REST/GraphQL API and therefore no securitySchemes. The only
  callable surface is the site MCP endpoint, which is ANONYMOUS: an unauthenticated
  JSON-RPC initialize and tools/list both returned HTTP 200 on 2026-09-12, and the
  company's own llms.txt states "No authentication required to connect to the MCP
  endpoint". A per-session visitor token exists one level down, minted by the
  GenerateVisitorToken tool and required only as an argument to CallWixSiteAPI /
  ExecuteWixAPI; it is not a credential a consumer registers for.
schemes:
- id: mcp-anonymous
  type: none
  applies_to: https://www.agragene.com/_api/mcp
  transport: http-jsonrpc
  evidence:
    url: https://www.agragene.com/_api/mcp
    method: POST tools/list (no Authorization header)
    http_status: 200
  note: Connection and tool enumeration require no credential of any kind.
- id: wix-visitor-token
  type: bearer-session
  applies_to: CallWixSiteAPI, ExecuteWixAPI
  issued_by: GenerateVisitorToken (MCP tool, no parameters)
  registration_required: false
  evidence:
    url: https://www.agragene.com/llms.txt
    quote: >-
      GenerateVisitorToken - Creates a new visitor session and obtains a visitor access
      token for the site. Must be called before making any CallWixSiteAPI request.
  note: >-
    Platform-minted anonymous session token, not a provider-issued API key. Scope is
    limited to public site information; no Wix business solution is installed on this
    site, so no transactional data is reachable with it.
oauth: false
api_keys: false
mutual_tls: false
openid_connect: false
notes:
- No /.well-known/oauth-protected-resource or /.well-known/oauth-authorization-server is served (HTTP 400 on both).
- No developer portal, signup, or key-provisioning flow exists on any Agragene host.