# Public access and authentication

SanktGaller Webdesign exposes only public, read-only discovery information. No account, login,
API key, OAuth flow, or payment credential is required.

## Public resources

- Site information: `/api/site-info`
- API catalog: `/.well-known/api-catalog`
- Agent Skills index: `/.well-known/agent-skills/index.json`
- Agent information card: `/.well-known/agent-card.json`
- MCP server card: `/.well-known/mcp/server-card.json`
- MCP endpoint: `/api/mcp`

The MCP endpoint returns public information and can prepare a `mailto:` link. It never sends an
email or changes external state. The user must review and send any message themselves.

Do not send passwords, API keys, payment details, or other secrets to these endpoints.