# Watermelon UI Auth Docs

Watermelon UI currently exposes public, read-only developer surfaces that do not require authentication. Agents and engineers can access the public docs, catalog endpoints, and hosted MCP discovery routes without bearer tokens, session cookies, or account login flows.

## No-auth surfaces

- [llms.txt](https://ui.watermelon.sh/llms.txt)
- [Sitemap](https://ui.watermelon.sh/sitemap.xml)
- [OpenAPI](https://ui.watermelon.sh/openapi.json)
- [Public API Docs](https://ui.watermelon.sh/api/docs)
- [Hosted MCP discovery](https://mcp.watermelon.sh/)
- [Hosted MCP endpoint](https://mcp.watermelon.sh/mcp)

## Public API

The current public HTTP API is read-only. It supports summary, listing, and single-entry lookup endpoints for the Watermelon catalog. Responses include structured JSON errors, versioning headers, deprecation headers on compatibility aliases, and rate-limit headers for self-throttling clients.

## MCP

The hosted Watermelon MCP server is also read-only and currently unauthenticated. It is intended for structured catalog access, not private account actions or repository mutation.