# Auth.md

> Agent registration metadata for Hefes LLC. AI agents and automated clients can use this document to discover how to register, authenticate, and interact with Hefes services.

## Agent Registration

AI agents can register to access Hefes services programmatically via the OAuth Authorization Server at `/.well-known/oauth-authorization-server`.

### Registration Endpoint

`POST https://hefes.net/oauth/register`

### Identity Types

- **Individual** — For personal use and testing
- **Organization** — For teams and enterprise deployments

### Credential Types

- `client_secret_basic` — HTTP Basic authentication with client ID and secret
- `client_secret_post` — Client ID and secret in POST body
- `private_key_jwt` — JWT signed with a private key (recommended for production)

### Supported Grants

| Grant Type | Use Case |
|---|---|
| `authorization_code` | User-interactive flows (web, mobile) |
| `client_credentials` | Server-to-server / agent-to-agent |

### Scopes

| Scope | Access |
|---|---|
| `mcp:tools:get_services` | Read Hefes services catalog |
| `mcp:tools:submit_project_inquiry` | Submit software or cloud project inquiries |
| `mcp:tools:contact_hefes` | Send general inquiries |
| `cloud:deploy` | Deploy cloud infrastructure |
| `cloud:manage` | Manage existing deployments |

## MCP Access (Current)

Currently, the Hefes MCP server at `https://mcp.hefes.net/mcp` operates with no authentication required (`auth: none`). This allows any AI agent to query the services catalog and submit inquiries.

### Available Tools

1. **`get_services`** — Returns the Hefes services catalog as Markdown
2. **`submit_project_inquiry`** — Structured intake for software or cloud project inquiries
3. **`contact_hefes`** — Free-form inquiry form

## Agent Discovery

### DNS-Based Discovery (DNS-AID)

```shell
dig SVCB _index._agents.hefes.net
# Priority: 1, Target: _agents.hefes.net, alpn: h2, port: 443
```

### Well-Known Discovery

| Path | Description |
|---|---|
| `/.well-known/mcp.json` | MCP server card |
| `/.well-known/api-catalog` | API service catalog |
| `/.well-known/oauth-authorization-server` | OAuth/OIDC provider metadata |
| `/.well-known/oauth-protected-resource` | Protected resource metadata |
| `/.well-known/agent-skills/index.json` | Agent skills index |
| `/auth.md` | This file — agent registration docs |

## Contact

For agent registration inquiries: **ryder@hefes.net**