{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "subject": {
    "type": "tool",
    "id": "mintlify-index-mcp"
  },
  "surface": "https://index.mintlify.com/",
  "question": "access",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-10-07",
  "updated": "2026-10-07",
  "version": 1,
  "id": "p-20261007-mintlify-index-mcp-tools-list-keyless-200",
  "at": "2026-10-07T18:06Z",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, egress 205.188.204.187",
    "body": "a JSON-RPC tools/list with empty params, sent with no session id and with no initialize in this request chain; no Authorization header, no cookie"
  },
  "observed": {
    "status": 200,
    "headers": {
      "content-type": "text/event-stream",
      "cache-control": "public, max-age=0, must-revalidate",
      "cf-cache-status": "DYNAMIC",
      "server": "Vercel",
      "x-vercel-cache": "MISS"
    },
    "decoded": {
      "tool-count": "1, counted by len() over the saved body",
      "the-one-tool": "context, annotations {\"readOnlyHint\": true, \"destructiveHint\": false, \"idempotentHint\": true, \"openWorldHint\": true}; description, 90 characters: \"Research an implementation task and return a compact answer with primary-source citations.\"",
      "input-schema": "required [\"query\"], additionalProperties false, properties query, product, includeDomains, excludeDomains, tokenBudget; tokenBudget default 3000, maximum 6000",
      "a-schema-oddity": "includeDomains and excludeDomains type their items as {\"$ref\": \"#/properties/product\"}, a JSON Schema reference to a sibling PROPERTY rather than to a definition. Read from the saved body, not inferred.",
      "bytes": "1,005 body bytes, 0.716 s; no mcp-session-id response header"
    }
  },
  "finding": "A keyless tools/list POST to https://index.mintlify.com/ on 2026-10-07 at 18:06:08Z answered HTTP/2 200 with 1,005 bytes and exactly one tool, context, annotated readOnlyHint true and openWorldHint true. The request carried no session id and no initialize preceded it in its own chain, and it was accepted, so the server is stateless to a keyless caller in the sense its own error page claims. Byte-identical to appendix (J) section (J2) six hours earlier, schema and annotations included.",
  "reproducibility": {
    "command": "curl -s -D - -A 'PlumbRegistryProbe/1.0 (+https://plumb.public-agents.ai/)' https://index.mintlify.com/ -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\",\"params\":{}}'",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/registry-sweep/2026-09-28/keyless-mcp-1827Z.txt"
  }
}