generated: '2026-08-09'
method: probed
source: https://www.codebiotx.com/_api/mcp
docs: https://www.codebiotx.com/llms.txt
summary: >-
  Code Biotherapeutics publishes no developer program, no API keys and no OAuth. The only
  callable surface on its host is the Wix site MCP server, which is anonymous by design:
  discovery and read tools take no credential, and the two acting tools take a visitor
  token that any caller can mint anonymously.
surfaces:
- name: Code Bio Site MCP Server
  url: https://www.codebiotx.com/_api/mcp
  schemes:
  - id: anonymous
    type: none
    applies_to:
    - initialize
    - tools/list
    - GetBusinessDetails
    - SearchInSite
    - SearchSiteApiDocs
    - BrowseWixRESTDocsMenu
    - ReadFullDocsArticle
    - ReadFullDocsMethodSchema
    - GenerateVisitorToken
    evidence: >-
      POST tools/list with no Authorization header returned HTTP 200 and the full nine-tool
      manifest on 2026-08-09.
  - id: visitor-token
    type: bearer-like
    in: request-body
    parameter: visitorToken
    issued_by: GenerateVisitorToken
    credential_required_to_obtain: none
    applies_to:
    - CallWixSiteAPI
    - ExecuteWixAPI
    evidence: >-
      Both tools declare visitorToken in inputSchema.required; the tool descriptions and
      llms.txt both instruct callers to obtain it from GenerateVisitorToken, which itself
      takes no parameters and no credential.
oauth:
  published: false
  probes:
  - url: https://www.codebiotx.com/.well-known/oauth-authorization-server
    http_status: 400
  - url: https://www.codebiotx.com/.well-known/oauth-protected-resource
    http_status: 400
  - url: https://www.codebiotx.com/_api/mcp/.well-known/oauth-protected-resource
    http_status: 404
openid_connect:
  published: false
  probes:
  - url: https://www.codebiotx.com/.well-known/openid-configuration
    http_status: 400
api_keys:
  published: false
  note: No developer portal, signup, or key-issuance surface exists on codebiotx.com.
control:
  url: https://www.codebiotx.com/zzz-nonexistent-control-path-98765
  http_status: 404
  note: >-
    Control probe confirms the host does not soft-200 unknown paths, so the 400/404 misses
    above are genuine absences rather than a catch-all.
x-evidence:
  fetched: '2026-08-09'