# auth.md — Umesh Malik

> Agent registration and authentication policy for https://umesh-malik.com.

## TL;DR for agents

This site is **public, read-only, and unauthenticated**. No registration is
required, no credentials are issued, and no OAuth/OIDC flow exists. All public
pages, blog posts, feeds, sitemaps, and machine-readable indexes can be
fetched directly without a token.

## Resource type

- **Type:** static personal portfolio + technical blog
- **Auth required:** none
- **Rate limit:** Cloudflare default (be reasonable; no auth keys are issued)
- **Robots:** see [/robots.txt](https://umesh-malik.com/robots.txt)

## Content usage signals

Per [contentsignals.org](https://contentsignals.org/) and the
`Content-Signal` directive in `robots.txt`:

```
Content-Signal: ai-train=yes, search=yes, ai-input=yes
```

The author allows AI training, search indexing, and use as agent input,
provided attribution links back to https://umesh-malik.com.

## Discovery

Agents looking for machine-readable resources should start at:

- API catalog (RFC 9727): [https://umesh-malik.com/.well-known/api-catalog](https://umesh-malik.com/.well-known/api-catalog)
- LLM-readable index: [https://umesh-malik.com/llms.txt](https://umesh-malik.com/llms.txt)
- LLM-readable full content: [https://umesh-malik.com/llms-full.txt](https://umesh-malik.com/llms-full.txt)
- AI/agent summary: [https://umesh-malik.com/ai-summary](https://umesh-malik.com/ai-summary)
- Sitemap: [https://umesh-malik.com/sitemap-index.xml](https://umesh-malik.com/sitemap-index.xml)
- JSON Feed: [https://umesh-malik.com/feed.json](https://umesh-malik.com/feed.json)
- RSS: [https://umesh-malik.com/rss.xml](https://umesh-malik.com/rss.xml)
- security.txt: [https://umesh-malik.com/.well-known/security.txt](https://umesh-malik.com/.well-known/security.txt)

## Agent registration

**No registration required — access is anonymous.** The only resource an agent
calls here is the MCP server at [https://umesh-malik.com/mcp](https://umesh-malik.com/mcp), and it is public.

OAuth Protected Resource Metadata (RFC 9728) is published so scanners and MCP
clients can discover this explicitly:
[https://umesh-malik.com/.well-known/oauth-protected-resource](https://umesh-malik.com/.well-known/oauth-protected-resource).
Its empty `authorization_servers`, `scopes_supported`, and
`bearer_methods_supported` arrays are the honest representation of an
unauthenticated resource.

```json
{
  "agent_auth": {
    "skill": "https://umesh-malik.com/auth.md",
    "audience": "AI agents and autonomous clients",
    "protected_resource_metadata": "https://umesh-malik.com/.well-known/oauth-protected-resource",
    "register_uri": "https://umesh-malik.com/auth/register",
    "identity_endpoint": "https://umesh-malik.com/auth/register",
    "claim_endpoint": "https://umesh-malik.com/auth/register",
    "identity_types_supported": ["anonymous"],
    "assertion_types_supported": [],
    "anonymous": { "credential_types_supported": ["none"], "claim_uri": "https://umesh-malik.com/auth/register" },
    "registration": { "required": false, "method": "anonymous", "register_uri": "https://umesh-malik.com/auth/register" },
    "credential_types": [],
    "claim_uri": "https://umesh-malik.com/auth/register",
    "revocation_uri": null
  }
}
```

**Registration flow (complete, anonymous):** an agent may register at
[https://umesh-malik.com/auth/register](https://umesh-malik.com/auth/register) (GET to describe, POST to
register). The endpoint acknowledges registration and returns
`credentials_required: false` — there is no claim ceremony and no credential,
because the resource is public. Agents can simply call
[https://umesh-malik.com/mcp](https://umesh-malik.com/mcp) directly.

The same `agent_auth` block is also published at
[https://umesh-malik.com/.well-known/oauth-authorization-server](https://umesh-malik.com/.well-known/oauth-authorization-server)
for scanners and agents that look there. That document is an **honest
anonymous-access declaration**, not a working OAuth server: it sets
`register_uri`, `claim_uri`, and `revocation_uri` to `null` and advertises
**no** `authorization_endpoint` or `token_endpoint`, because none exist. No
fake endpoints are published — a client reading it learns that access is
anonymous and no registration is required. If authenticated APIs are added
later, real endpoints and a populated `agent_auth` block ship in the same change.

## Contact

For collaboration, integration questions, or to report a discovery problem:

- Email: ask@umesh-malik.com
- GitHub: https://github.com/Umeshmalik
- LinkedIn: https://linkedin.com/in/umesh-malik

_Last updated: 2026-07-27._