# auth.md

Most of this corpus needs no credential at all. An MCP client that connects to `https://mcp.ryanlindsey.me/mcp` with no `Authorization` header reaches the public tier: the résumé, every published case study and post, semantic search over that corpus, and a tool that explains how to reach Ryan. Every result cites a URL a browser can open on its own, and nothing served at this tier depends on holding a token.

Some material on this site is served to scoped tokens rather than published: reference contacts, engagement logistics, and the unredacted layer of a few case studies. This is an ordinary access tier, not a waiting list. Email hello@ryanlindsey.me with who you are and what you are evaluating, and Ryan will issue a scoped, expiring token if it fits. Public tools cover the portfolio in full.

## Scopes

A token carries one or more of these scopes:

- `fit`
- `profile`
- `documents`
- `narrative`

## No self-service registration

There is no authorization server behind this endpoint and no self-service registration endpoint. A token is minted by hand, after the email above, and handed to one person; nothing here issues one to a caller that asks. The one exception is internal and reaches nobody outside: the scheduled test runs on this site's own infrastructure sign a short-lived token for themselves and revoke it when the run ends. The machine-readable description of what this endpoint accepts lives at `/.well-known/oauth-protected-resource`, on this origin and on the MCP endpoint's own origin.