# auth.md — mcp.cpgknowledgegraph.ai (GreenCore Solutions Corp.)

## Posture

Public content and machine files on this surface are **open by design** — no authentication is required. Discovery endpoints (/.well-known/*) are public. The MCP endpoint (https://mcp.cpgknowledgegraph.ai/mcp) serves its read tools openly: an unauthenticated `initialize` answers 200 with the server card, there is no sign-in, no bearer token, no `WWW-Authenticate` challenge and no dynamic client registration.

**No OAuth discovery metadata is published here.** `/.well-known/oauth-protected-resource`, `/.well-known/oauth-protected-resource/mcp`, `/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration` answer 404 (since 2026-09-14): a resource that publishes authorization-server metadata without a registration endpoint makes RFC 9728-aware MCP clients attempt client registration and refuse to connect. Connect with the bare URL.

Transactional agentic commerce is authorized at the **GSC Navigator boundary** using **Microsoft Entra OAuth 2.0** (2-factor; human-in-the-loop on every commit). Scope of authority: reads are autonomous; every transactional commit is human-signed.

## Enforcement posture — the sign (declared 2026-08-24)

These endpoints are open by design. When the buy side's credential standard reaches GA — expected Q4 2026-Q1 2027 — transactional methods migrate to OAuth 2.1 challenge per the MCP 2025-11-25 specification. Read access stays open. That is not pending work; that is the published plan.

```json
{
  "enforcement_posture": "open-by-declaration",
  "migration_standard": "OAuth 2.1 + PKCE challenge (401 + WWW-Authenticate) on mcp:transact methods, per MCP spec 2025-11-25",
  "migration_trigger": "ecosystem GA of credentialed counterparties (enterprise A2A/MCP buy-side GA)",
  "migration_window": "Q4 2026 - Q1 2027",
  "declared": "2026-08-24",
  "operator": "GreenCore Solutions Corp.",
  "duns": "24-336-6774"
}
```

## Resource

- Resource: https://mcp.cpgknowledgegraph.ai
- MCP resource: https://mcp.cpgknowledgegraph.ai/mcp (streamable-http; stateful — `tools/list` and `tools/call` carry the `Mcp-Session-Id` returned by `initialize`)
- Documentation: https://mcp.cpgknowledgegraph.ai/docs · Support: https://mcp.cpgknowledgegraph.ai/support
- Authorization server for transactional credentials (Microsoft Entra, at the Navigator boundary only): https://login.microsoftonline.com/54939635-2f2e-465a-8526-a907cb3c8ebd/v2.0
- Where a token is used it is presented as a Bearer token in the Authorization header.

## Scopes (resource scopes — not human-login scopes)

- `mcp:read` — Read/resolve/discovery calls on the SPARKS CPG Knowledge Graph over MCP. Open on this surface; declared for the transactional migration.

## PKCE and resource indication (transactional migration)

- Authorization-code requests will use **PKCE** (S256).
- **RFC 8707 resource indication**: the resource URI for this surface's MCP endpoint is https://mcp.cpgknowledgegraph.ai/mcp. At the Microsoft Entra v2 endpoint the resource is carried as the scope prefix (`scope=<resource>/.default`).
- Protocol: ACM-68000.

## Agent registration (self-contained flow)

- **Agent audience:** AI agents and operators integrating with the SPARKS CPG Knowledge Graph (mcp.cpgknowledgegraph.ai) over MCP.
- **Registration endpoint:** https://gsc-navigator.ai/ — GSC Navigator, the Human-in-the-Loop inbound (POST https://formspree.io/f/xaqrznpe with fields name, email, message). There is no self-serve dynamic client registration; every registration is human-reviewed.
- **Supported method — verified email:** GSC verifies the operator's email, then provisions credentials after review.
- **Credential use:** GSC issues **Microsoft Entra OAuth 2.0 client credentials** (client_credentials grant against the issuer above); present the access token as a **Bearer token in the Authorization header**. Revocation on request via the same endpoint.

```json
{
  "agent_auth": {
    "skill": "https://mcp.cpgknowledgegraph.ai/auth.md",
    "register_uri": "https://gsc-navigator.ai/",
    "identity_types_supported": [
      "identity_assertion"
    ],
    "identity_assertion": {
      "assertion_types_supported": [
        "verified_email"
      ],
      "credential_types_supported": [
        "oauth2_client_credentials"
      ]
    },
    "claim_uri": "https://gsc-navigator.ai/"
  }
}
```

Operator: GreenCore Solutions Corp. · D-U-N-S 24-336-6774 · Microsoft AI Cloud Partner.