Cognizant Technology Authentication

generated: '2026-11-04'
method: none
source: https://github.com/cognizant-ai-lab/neuro-san/blob/main/README.md + https://github.com/cognizant-ai-lab/neuro-san/blob/main/docs/mcp_service.md
  + openapi/cognizant-technology-neuro-san-agent-service.json
docs: https://github.com/cognizant-ai-lab/neuro-san#readme
note: 'HEADLINE FINDING, recorded plainly: the published NeuroSan OpenAPI declares NO securitySchemes and applies
  no security to any of its four operations, and the MCP service documentation shows unauthenticated curl calls
  carrying only Content-Type and MCP-Protocol-Version headers. The contract as published describes an OPEN surface.
  That is not the whole picture, and the difference matters. Neuro SAN is self-hosted software, so the deployment
  boundary — not the contract — is where an operator is expected to put authentication. The provider does document
  two real, first-party authorization mechanisms in prose, neither of which appears in the machine-readable contract.
  Both are listed below as documented-but-unspecified so an agent author knows they exist and knows they cannot
  be discovered from the spec.'
schemes: []
schemes_note: Empty by observation, not by omission. components.securitySchemes is absent from the published OpenAPI
  and no top-level or operation-level `security` block appears.
documented_but_not_in_contract:
- name: per-user authorization for agent networks
  kind: external-authorization
  source: neuro-san README feature list
  detail: '"per-user authorization for Agent Networks - optional implementations include: OpenFGA". An optional,
    pluggable authorization layer the operator wires in. Not described in the OpenAPI, so an agent cannot discover
    whether a given deployment enforces it.'
  enforced_by: operator
- name: Bring-Your-Own-Key (BYOK)
  kind: client-supplied-credential
  source: neuro-san README feature list
  detail: '"Secure Bring-Your-Own-Key (BYOK) support for client-provided API keys so your deployments do not have
    to shoulder everyone else''s token costs." These are LLM-PROVIDER keys (OpenAI and similar) that the caller
    supplies, not credentials for the neuro-san API itself — an important distinction. They travel over the private
    sly_data channel rather than an Authorization header, which is why they never surface as a securityScheme.'
  enforced_by: client
  transport: sly_data (private channel, deliberately excluded from the LLM chat stream)
  evidence: neuro_san/registries/music_nerd_pro_sly_api_key.hocon and the paired test fixtures (tests/fixtures/music_nerd_pro_sly_api_key/{no_user_api_key,with_user_api_key}.hocon)
    are the provider's own worked examples of an agent network that takes a user-supplied API key through sly_data.
server_side_credentials:
  note: The credentials an OPERATOR must set to run a server are environment variables for downstream LLM providers,
    not credentials for this API.
  environment_variables:
  - OPENAI_API_KEY
  - AGENT_TOOL_PATH
  - AGENT_MANIFEST_FILE
  - PYTHONPATH
oauth2: false
openid_connect: false
mutual_tls: false
api_key_header: null
transport_security:
  https_enforced: false
  detail: The provider's own documented examples use http://localhost:8080. TLS termination is the operator's responsibility;
    nothing in the contract or docs requires it.
agent_guidance: An agent integrating with a neuro-san deployment cannot learn the auth model from the contract and
  must ask the operator. Assume no authentication is declared, expect the deployment to sit behind whatever the
  operator put in front of it, and expect any LLM-provider key to be passed through sly_data rather than a header.
method_note: 'method: none because the published contract declares no securitySchemes and no security requirement
  on any operation - checked, nothing there. The documented_but_not_in_contract list below records the operator-side
  mechanisms the docs describe; none of them is a scheme a client can read from the contract, which is why schemes[]
  stays empty rather than being filled from prose.'