Calviri Authentication

generated: '2026-08-09'
method: probed
source: https://www.calviri.com/_api/mcp
docs: https://dev.wix.com/docs/develop-websites/articles/get-started/about-the-wix-site-mcp
description: >-
  Calviri publishes no product API and therefore no API-key, OAuth or OIDC
  program. The only callable surface on its host is the Wix-provisioned site MCP
  endpoint, and that endpoint is ANONYMOUS: an unauthenticated POST of
  `initialize` and of `tools/list` both returned 200 on 2026-08-09 with no
  credential of any kind. Write-side calls are gated only by a visitor access
  token that the server itself mints anonymously via the GenerateVisitorToken
  tool — there is no authorization server, no client registration and no scope
  surface. Derived from the live probe, not from a spec: there is no OpenAPI to
  read securitySchemes from.
apis:
- name: Calviri Site MCP
  url: https://www.calviri.com/_api/mcp
  schemes:
  - id: anonymous
    type: none
    in: n/a
    description: >-
      No credential is required to connect, initialize, or list tools. The
      server exposes only information already public on www.calviri.com.
    evidence:
      url: https://www.calviri.com/_api/mcp
      method: 'POST tools/list (no Authorization header)'
      http_status: 200
      fetched: '2026-08-09'
  - id: visitor-token
    type: bearer-like
    in: request body
    parameter: visitorToken
    description: >-
      CallWixSiteAPI and ExecuteWixAPI require a `visitorToken` argument. The
      token is obtained by calling the GenerateVisitorToken tool on the same
      anonymous session; it identifies a visitor session, not a registered
      developer, and no signup or key issuance is involved.
    minted_by: GenerateVisitorToken
oauth:
  present: false
  authorization_server: null
  protected_resource_metadata: null
  notes: >-
    /.well-known/oauth-authorization-server returns 400 (Wix edge behaviour for
    all /.well-known/* paths) and
    /_api/mcp/.well-known/oauth-protected-resource returns 404. RFC 8414 and
    RFC 9728 metadata are absent.
api_keys:
  present: false
mutual_tls:
  present: false
x-evidence:
- fetched: '2026-08-09'
  url: https://www.calviri.com/_api/mcp
  http_status: 200
- fetched: '2026-08-09'
  url: https://www.calviri.com/.well-known/oauth-authorization-server
  http_status: 400
- fetched: '2026-08-09'
  url: https://www.calviri.com/_api/mcp/.well-known/oauth-protected-resource
  http_status: 404