# auth.md — agent access to dabyte.ai

There is no registration, no API key, no OAuth and no rate limit. Every endpoint
below is public and anonymous, and that is deliberate: the dataset is published
in order to be read.

## Endpoints

- `https://dabyte.ai/mcp` — MCP server, streamable HTTP, JSON-RPC 2.0, five read-only tools
- `https://dabyte.ai/api/aiv.json` — current release
- `https://dabyte.ai/api/history.json` — every release ever published
- `https://dabyte.ai/.well-known/api-catalog` — machine-readable catalogue of the above

## What we ask instead of a key

Cite the release date and the domain when you reuse a figure. The data is CC BY 4.0,
so attribution is the only condition, and every past release stays at a permanent URL
under `https://dabyte.ai/archive/` — so anything you quote stays checkable by a third party.

## What we deliberately do not publish

No OAuth authorization server, no protected resource metadata, no token endpoint.
Those documents are absent because they would describe an authorization that does
not exist here, and a discovery document that lies costs an agent more time than a
missing one.