# auth.md

You are an agent. This file tells you how to authenticate to aureum-tech.com, the website of Aureum Technology GmbH, an IT service company and digital studio in Rodewisch, Germany. You do not need to authenticate. Every agent interface on this site is public and read-only, and none of them takes a registration, a credential or a token. Steps 2 to 5 are empty on purpose. Go to Step 6.

The sections follow the order of the auth.md format (https://github.com/workos/auth.md) so you can check each step quickly. This file describes the absence of agent registration. It is not an `agent_auth` profile.

Last reviewed: 2026-11-14

## Who this is for

AI agents and assistants acting for a user, MCP clients, and the developers who configure them. A person who needs IT help from Aureum should use the contacts at the end of this file.

## Step 1: Discover

This site publishes no OAuth discovery metadata, because nothing an agent can reach here is OAuth-protected:

- `/.well-known/oauth-protected-resource`: not published (404).
- `/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration`: not published (404). There is no authorization server.
- There is no `agent_auth` block. The agent interfaces listed in this file never answer with 401 or a `WWW-Authenticate` challenge.

These machine-readable descriptions do exist:

- MCP Server Card: https://aureum-tech.com/.well-known/mcp/server-card.json (it states `"authentication": { "required": false }`)
- OpenAPI description of the MCP HTTP interface: https://aureum-tech.com/openapi.json
- A2A Agent Card: https://aureum-tech.com/.well-known/agent-card.json (no `securitySchemes`, because none apply)
- API catalog (RFC 9727): https://aureum-tech.com/.well-known/api-catalog
- Agent skills index: https://aureum-tech.com/.well-known/agent-skills/index.json
- Human-readable overview (German): https://aureum-tech.com/ki-zugang
- Site summary for language models: https://aureum-tech.com/llms.txt and https://aureum-tech.com/llms-full.txt

If another document or a scanner suggests something else, this file and the MCP Server Card are authoritative.

## Step 2: Pick a method

There is nothing to pick. This service accepts none of the auth.md registration types: `identity_assertion` (ID-JAG), `service_auth` and `anonymous`.

On this site, anonymous access means plain requests without any credential. It is not the auth.md `anonymous` registration type: you do not register, you receive no `identity_assertion`, and there are no `pre_claim_scopes` or `post_claim_scopes`.

## Step 3: Register

There is no registration or provisioning endpoint. `POST /agent/identity` does not exist on this host. This site offers no accounts for users or agents, so do not try to create one for your user.

## Step 4: Claim ceremony

Not applicable. There is no claim endpoint, no `user_code` and no `verification_uri`. Never ask your user to confirm a code on behalf of this site.

## Step 5: Exchange the assertion

Not applicable. There is no token endpoint. This service issues no access tokens, refresh tokens, API keys or client IDs.

## Step 6: Use the service

Endpoint: `https://aureum-tech.com/mcp`
Transport: MCP Streamable HTTP, JSON-RPC 2.0 over `POST`

1. `POST` an `initialize` request without a session header. The response carries an `Mcp-Session-Id` header.
2. Send that `Mcp-Session-Id` with every later request in the session.
3. Call `tools/list`, then `tools/call`.

Do not send an `Authorization` header or any other credential. Nothing checks it, and browser-based clients will fail the CORS preflight because `Authorization` is not an allowed request header here.

The same tools are also available over A2A: `POST https://aureum-tech.com/a2a` (A2A protocol 1.0, JSON-RPC binding) with the header `A2A-Version: 1.0`. A message with a data part `{"werkzeug": "<tool name>", "eingabe": {…}}` runs a tool; a text-only message returns the tool list. No credential either, and the same limits apply.

A `GET /mcp` without `Mcp-Session-Id` answers 405. That is the expected reply to a GET, not an outage. For a liveness check, use `GET https://aureum-tech.com/mcp/health`.

The tools cover company and contact data (`firma_und_kontakt`), services (`leistungen_auflisten`), current prices (`preise_abfragen`), a search over all pages (`website_suchen`), and calculators and checkers named `werkzeug_*`, for example the Windows 10 support check, a Wi-Fi access point planner, an SPF/DKIM/DMARC check and a robots.txt tester. `tools/list` returns the current set. Tool descriptions and results are in German.

Every tool only reads or calculates. No tool submits a form, books an appointment or sends a message. If your user wants to order or book something, pass on the contacts below.

## Limits

| Limit | Value | What you receive |
| --- | --- | --- |
| Request body | 900 KB | HTTP 413 |
| Open sessions, all clients together | 500 | HTTP 503 with `Retry-After: 30` |
| Idle session | expires after 30 minutes | HTTP 404 with JSON-RPC error `-32001`; send `initialize` again |
| Computing time per call (calculation tools) | 10 seconds | tool error; retry with a smaller input |
| Tools that fetch from the network (`werkzeug_email_check`, `werkzeug_ki_crawler_check`, `werkzeug_drittanbieter_check`, `werkzeug_link_vorschau_check`) | 20 or 30 calls per minute shared by all callers, plus hourly and concurrency caps | tool error; retry after a minute |

Tool errors arrive as a normal `tools/call` result with `isError: true` and a German message in the field `fehler`.

## Errors

| Status | Where | What to do |
| --- | --- | --- |
| 400, JSON-RPC `-32700` | `/mcp` | The body is not valid JSON. Fix the request. |
| 400, JSON-RPC `-32000` | `/mcp` | No session yet. Send `initialize` first. |
| 404, JSON-RPC `-32001` | `/mcp` | Session unknown or expired. Send `initialize` again. |
| 405 | `/mcp` | GET or DELETE without `Mcp-Session-Id`. Use POST. |
| 413 | `/mcp` | Body too large. Send less. |
| 500 | `/mcp` | Internal error. Retry once with backoff. |
| 502 | `/mcp` | The MCP process is not running. The website stays up; retry later. |
| 503 | `/mcp` | Session limit reached. Wait `Retry-After` seconds, then retry. |

For 5xx, back off exponentially and retry the same request. For 4xx, do not resend the same payload; act on the table.

## Revocation

There is nothing to revoke. You hold no credential from this service, and this service receives no security events.

## Data, cost and legal

The MCP server has no user accounts and keeps sessions only in memory. It returns tool results without storing them. The privacy policy (German) describes what the web server logs: https://aureum-tech.com/datenschutz. Legal notice: https://aureum-tech.com/impressum.

There is no paid tier and no payment flow for the MCP server.

## Contact

For people, not for automated requests:

- Aureum Technology GmbH, Straße der Jugend 5, 08228 Rodewisch, Germany
- Phone: +49 3744 4399760 (Mo-Fr 08:00-17:00, Europe/Berlin)
- Email: info@aureum-tech.com (German or English)
- Contact page: https://aureum-tech.com/kontakt
- Security reports: https://aureum-tech.com/.well-known/security.txt