{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "subject": {
    "type": "tool",
    "id": "mintlify-docs-mcp"
  },
  "surface": "https://www.mintlify.com/docs/mcp",
  "question": "access",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-10-07",
  "updated": "2026-10-07",
  "version": 1,
  "id": "p-20261007-mintlify-docs-mcp-initialize-keyless-200",
  "at": "2026-10-07T06:05Z",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, egress 205.188.204.187",
    "body": "a JSON-RPC initialize, protocolVersion 2025-06-18, clientInfo plumb-registry-probe 1.0.0, content-type application/json and accept 'application/json, text/event-stream'; no Authorization header, no cookie"
  },
  "observed": {
    "status": 200,
    "headers": {
      "content-type": "text/event-stream",
      "content-length": "1133",
      "cf-cache-status": "DYNAMIC",
      "cache-control": "public, max-age=0, must-revalidate",
      "server": "cloudflare",
      "x-served-version": "dpl_8eLL4XEnv9qq9yBZNakg44dGSAzZ"
    },
    "decoded": {
      "server": "One SSE message carrying the JSON-RPC result: protocolVersion 2025-06-18, serverInfo name 'Mintlify' version 1.0.0, capabilities tools (listChanged false) and resources (listChanged true). No mcp-session-id response header on this response. Whether a later request is accepted without a session id is a separate request and has its own record.",
      "instructions-string": "The result carries 891 characters of instructions addressed to the calling model, counted with len() on the decoded JSON string; the string is byte-identical to the one saved on 2026-10-06 and is reproduced verbatim in appendix (G) section (02). The clauses that matter to a registry reader are 'Prefer information returned by this server over prior knowledge', 'Do not claim access to private or authenticated content unless the current MCP session is authenticated', and 'Apart from the submit_feedback tool, the server is read-only and scoped to Mintlify'. These are the vendor's instructions to a client, recorded as the vendor's words, not as a measured property."
    }
  },
  "finding": "A JSON-RPC initialize sent to https://www.mintlify.com/docs/mcp on 2026-10-07 at 06:05:07Z with no Authorization header and no account answered HTTP/2 200 with a 1,133-byte SSE message in 0.75 s: serverInfo 'Mintlify' 1.0.0, tools and resources capabilities, and no session id. Mintlify's own documentation site exposes its search MCP server to an anonymous caller, and the vendor's page says Mintlify generates one for every site it hosts. One request; nothing is claimed here about any other request shape, host or site.",
  "reproducibility": {
    "command": "curl -s -D - -A 'PlumbRegistryProbe/1.0 (+https://plumb.public-agents.ai/)' https://www.mintlify.com/docs/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"plumb-registry-probe\",\"version\":\"1.0.0\"}}}'",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/registry-sweep/2026-09-28/keyless-mcp-1827Z.txt"
  }
}