# Pilot MCP auth.md

Authentication and registration notes for AI agents using Pilot's hotel search MCP server.

## Audience

AI agents, assistants and MCP clients connecting to `https://mcp.pilotplans.com/mcp` on behalf of a user, or on their own.

## Authentication required

None. The server is public, read-only and anonymous.

## Registration

Not required, and there is no registration endpoint. There is no API key to request, no OAuth client to register and no user sign-in. Send MCP requests (Streamable HTTP, JSON-RPC 2.0) straight to the endpoint.

## Supported methods

| Method    | Credentials | Notes                                       |
| --------- | ----------- | ------------------------------------------- |
| Anonymous | None        | Every tool is available without credentials |

## Using credentials

Send no `Authorization` header. The server does not issue or check tokens, so clients should choose "No authentication" when asked.

## If this changes

If a tool ever requires authentication, the server will answer with `401 Unauthorized` and a `WWW-Authenticate` header, and publish OAuth Protected Resource Metadata (RFC 9728) at `https://mcp.pilotplans.com/.well-known/oauth-protected-resource`, per the MCP authorization specification. Until then, no `/.well-known/oauth-*` documents exist on this origin.

## More

- Documentation: https://mcp.pilotplans.com/
- MCP Server Card: https://mcp.pilotplans.com/.well-known/mcp/server-card.json