Horizon Robotics Authentication

generated: '2026-08-22'
method: probed
source: https://mcp.oe.horizon.auto/mcp
docs: https://github.com/HorizonRobotics/OE-Skills/blob/main/README.en.md
summary: >-
  Horizon Robotics' one publicly reachable machine surface — the Open Explorer MCP
  server — requires no authentication at all. Anonymous POSTs from plain curl completed
  `initialize`, `tools/list`, `resources/list` and `resources/read` with no Authorization
  header, no session token, no client registration and no OAuth challenge. There is no
  OAuth 2.0 authorization server, no OpenID Connect discovery document, and no API-key
  scheme anywhere in the published surface. The credentialed wall at Horizon sits one
  layer out: a developer-portal account is needed to DOWNLOAD the OpenExplorer package,
  not to CALL the MCP server.
schemes:
- id: none
  surface: https://mcp.oe.horizon.auto/mcp
  type: none
  applied: true
  evidence: >-
    initialize + tools/list + resources/list + resources/read all returned HTTP 200 with
    valid JSON-RPC results on unauthenticated requests, 2026-08-22.
oauth:
  supported: false
  probes:
  - url: https://mcp.oe.horizon.auto/.well-known/oauth-protected-resource
    status: 404
  - url: https://mcp.oe.horizon.auto/.well-known/oauth-authorization-server
    status: 404
  - url: https://www.horizon.auto/.well-known/oauth-authorization-server
    status: 404
openid_connect:
  supported: false
  probes:
  - url: https://www.horizon.auto/.well-known/openid-configuration
    status: 404
  - url: https://mcp.oe.horizon.auto/.well-known/openid-configuration
    status: 404
account_gates:
- surface: https://developer.horizon.auto/
  gate: developer portal account
  what_it_unlocks: OpenExplorer (OE) package downloads, chip documentation downloads, forum posting
  login_url: https://developer.horizon.auto/login
  probe: {url: 'https://developer.horizon.auto/login', status: 200}
  note: >-
    Documentation browsing at developer.horizon.auto/docs and doc.oe.horizon.auto is
    readable without an account; the download endpoints are what require one.
- surface: OEM / production silicon programs
  gate: commercial agreement with a Horizon Robotics project manager
  note: Stated in the product-security policy for OEM partners.
observations:
  transport_security:
    mcp_endpoint_tls: TLSv1.3
    mcp_endpoint_hsts: false
    note: >-
      mcp.oe.horizon.auto serves TLS 1.3 but sends no Strict-Transport-Security header —
      recorded in security/horizon-robotics-domain-security.yml.
  exposure_note: >-
    An unauthenticated, unrate-limited MCP endpoint that performs vector search over
    indexed codebases and documentation is a real operational surface. It is not named in
    the in-scope list of the company's own product-security policy.
x-evidence:
  fetched: '2026-08-22'
  urls:
  - url: https://mcp.oe.horizon.auto/mcp
    status: 200
    note: JSON-RPC initialize, anonymous
  - url: https://developer.horizon.auto/login
    status: 200