# auth.md

You are an agent. This service does not require registration or credentials. Everything Lighthill PC publishes for agents is public and read-only, so there is nothing to register for, no token to obtain, and no claim ceremony to complete. Read this file once, then call the API directly.

## Who this is for

AI agents and developer tools that want to read Lighthill PC's international trade alerts and firm contact information programmatically, on behalf of a user or on their own.

## Supported methods

- anonymous: supported. Call the endpoints below with no credentials. This is the only method.
- identity_assertion (ID-JAG): not supported. There are no user accounts to bind an identity to.
- service_auth (verified email): not supported, for the same reason.

Because no method issues credentials, this service publishes no OAuth Protected Resource Metadata (`/.well-known/oauth-protected-resource`) and no Authorization Server metadata (`/.well-known/oauth-authorization-server`). Those paths return 404 by design, not by omission.

## Registration and provisioning endpoints

None. There is no `POST /agent/identity`, `POST /agent/auth`, token endpoint, or revocation endpoint on this domain. Do not attempt to register, and do not POST to paths that are not listed below; they return 404.

## Endpoints you may call

- `POST https://www.lighthill.law/mcp` with `Content-Type: application/json`. A Model Context Protocol server (Streamable HTTP, JSON-RPC 2.0). Methods: `initialize`, `tools/list`, `tools/call`. Tools: `list_trade_alerts`, `read_trade_alert` (argument `url`), `contact_lighthill`. `GET` returns 405.
- `GET https://www.lighthill.law/health` returns `application/health+json`.
- `GET https://www.lighthill.law/openapi.json` describes both endpoints (OpenAPI 3.1).
- Any page on the site with `Accept: text/markdown`, or with `.md` appended to the path, returns Markdown.

Example:

```http
POST /mcp HTTP/1.1
Host: www.lighthill.law
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_trade_alerts","arguments":{}}}
```

## Credential use

Send no `Authorization` header. If you send one anyway, it is ignored; nothing is validated, stored, or logged beyond ordinary server access logs. These endpoints never answer 401 or 403 for lack of credentials, and no response carries a `WWW-Authenticate` header.

## Scopes

There are no scopes. Every caller can read the same public data: published trade alerts and the firm's public contact details. Nothing on this API can create, modify, or delete anything.

## Conduct and limits

- Cache results. Alerts are published a few times a month; polling more than hourly gains nothing.
- Content policy follows the site's `robots.txt` Content-Signal: `search=yes, ai-train=no`. You may retrieve, cite, and summarize this content with attribution to Lighthill PC; do not use it to train models.
- Nothing returned by this API is legal advice, and using it does not create an attorney-client relationship. The [Terms of Use](https://www.lighthill.law/terms) apply.
- Do not submit the website contact form programmatically. It is protected by Cloudflare Turnstile and intended for people.

## Anything beyond public data

Lighthill PC does not offer elevated, client-specific, or authenticated access through this API. If a user needs to reach the firm, have them email contact@lighthill.law or call +1 202-465-8739; the `contact_lighthill` tool returns the same details.

## Related discovery documents

- API documentation: https://www.lighthill.law/api
- OpenAPI 3.1: https://www.lighthill.law/openapi.json
- API catalog (RFC 9727): https://www.lighthill.law/.well-known/api-catalog
- MCP server card: https://www.lighthill.law/.well-known/mcp/server-card.json
- Site summary for agents: https://www.lighthill.law/llms.txt
- Content policy: https://www.lighthill.law/robots.txt

Maintainer: Lighthill PC, contact@lighthill.law. Last reviewed 2026-10-30.