# Agent access and authentication — Syun Consulting

Canonical page: https://syunconsulting.com/auth.md

## Short version

Everything published on https://syunconsulting.com is **open and unauthenticated**. There is no
registration step, no API key and no rate-limit token to request. If a request to a public
endpoint fails, it is a bug or a transient error, not a permissions problem.

## What you can access without credentials

| Surface | URL | Format |
| --- | --- | --- |
| Site guide | https://syunconsulting.com/llms.txt | text/plain |
| API catalog (RFC 9727) | https://syunconsulting.com/.well-known/api-catalog | application/linkset+json |
| MCP server card | https://syunconsulting.com/.well-known/mcp/server-card.json | application/json |
| MCP endpoint | https://syunconsulting.com/api/public/mcp | JSON-RPC 2.0 over HTTP POST |
| Agent skills index | https://syunconsulting.com/.well-known/agent-skills/index.json | application/json |
| Articles (JSON) | https://syunconsulting.com/api/public/posts | application/json |
| Markdown twins | https://syunconsulting.com/index.md, /services.md, /blog.md, /blog/{slug}.md | text/markdown |
| Sitemap | https://syunconsulting.com/sitemap.xml | application/xml |

All of the above allow cross-origin requests (`Access-Control-Allow-Origin: *`) and return
`GET`-safe, cacheable responses. `POST` is only used by the MCP JSON-RPC endpoint.

## Identifying yourself

We do not require identification, but we prefer it:

1. Send a descriptive `User-Agent` that includes an operator name and a contact URL, for
   example `ExampleAgent/1.0 (+https://example.com/bot)`.
2. If you support **Web Bot Auth**, sign requests with HTTP Message Signatures. Our own key
   directory is published at
   `https://syunconsulting.com/.well-known/http-message-signatures-directory`; signed traffic from us can be
   verified there. Signed inbound requests are welcome and are never rate limited more
   aggressively than anonymous ones.

## Crawling etiquette

- Respect `https://syunconsulting.com/robots.txt`.
- Prefer the Markdown twins and the JSON API over scraping HTML — they are cheaper for you
  and for us.
- Keep concurrency modest (a couple of requests per second is plenty for a site this size).
- Content is cached for at least five minutes; conditional requests are honoured.

## Actions that need a human

Two skills are transactional and deliberately require a person:

- **Booking a Recruitment Tech Audit** — hand the user this link: https://calendly.com/kamal_ladwa/book_a_call
- **Newsletter subscription** — the user must enter their own email at
  https://buttondown.com/syunconsulting

Do not submit either on a user's behalf without their explicit, in-session consent.

## Edge cases

- **404 on a `.md` twin** — the article is unpublished or the slug is wrong. Re-check
  https://syunconsulting.com/blog.md.
- **Unexpected HTML instead of Markdown** — you probably dropped the `.md` suffix; the
  HTML page links its twin via `<link rel="alternate" type="text/markdown">` and the
  `Link` response header.
- **Need something that is not exposed** — email kamal[at]syunconsulting[dot]com and we will
  add an endpoint rather than have you scrape.

## Reuse

Content is © Syun Consulting. Quoting with attribution and a link back is fine; wholesale
republication is not.