{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20261009-cloudflare-mcp-docs-tools-call-keyless",
  "subject": {
    "type": "tool",
    "id": "cloudflare-mcp"
  },
  "surface": "https://docs.mcp.cloudflare.com/mcp",
  "question": "access",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, one IP",
    "body": "an MCP tools/call of search_cloudflare_documentation with the query 'how does Workers billing work', sent alone with MCP-Protocol-Version 2025-06-18, no session id and no prior handshake on the connection; section (P5) of the artifact, sent 18:10:22Z, shown cut at 6,000 of 37,280 bytes"
  },
  "observed": {
    "status": 200,
    "headers": {
      "content-type": "text/event-stream",
      "cache-control": "no-cache, no-transform",
      "access-control-allow-origin": "*",
      "server": "cloudflare"
    },
    "decoded": {
      "result": "a JSON-RPC result on the event stream carrying documentation chunks, each with its source URL, title and text: the first is https://developers.cloudflare.com/ai-gateway/features/unified-billing/ ('Unified Billing'), the same first chunk the 2026-09-23 reading got",
      "no-challenge": "no www-authenticate header and no refusal of any kind; the call was answered on its merits",
      "session": "no session id was sent with this call and the server answered it anyway, as on 2026-09-23",
      "not-measured": "the second tool, migrate_pages_to_workers_guide, was not called; the response was not read past its first chunk for relevance",
      "why-re-sent": "Re-sent 2026-10-09 because the record of this request from 2026-09-23 (p-20260923-cloudflare-mcp-docs-tools-call-keyless) was filed before this prober kept transcripts and names no artifact; this one does. Nothing measured changed."
    }
  },
  "finding": "Cloudflare's Documentation MCP server still answers a keyless tools/call with real documentation: search_cloudflare_documentation returned source-attributed chunks from developers.cloudflare.com to a caller with no credentials, no account and no session id, sixteen days after the 2026-09-23 reading and with the same first chunk. This is the measurement the entry's noAccountNeeded cell rests on, now with a transcript that carries the request and its sent time. Everything here is one query to one of the server's two tools from one IP; it does not measure rate limits, the second tool, or the quality of the answer.",
  "reproducibility": {
    "command": "curl -sS -i -m 25 -X POST https://docs.mcp.cloudflare.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -H 'MCP-Protocol-Version: 2025-06-18' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"search_cloudflare_documentation\",\"arguments\":{\"query\":\"how does Workers billing work\"}}}'",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/registry-sweep/2026-09-28/keyless-mcp-1827Z.txt"
  },
  "at": "2026-10-09T18:10Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-10-09",
  "updated": "2026-10-09",
  "version": 1
}