{"app":"13flow","contract":["Public tools must not require browser auth, cookies or checkout.","Private tools must fail closed without a valid operator-issued credential.","MCP responses must expose product status, validation boundary and data-quality warnings.","Tool output must not claim validated alpha, probabilities or expected returns.","Private MCP tools call the isolated private API service rather than reading the private DB directly."],"generated_at":"2026-07-15T23:13:54+00:00","git_sha":"d002a2dd2ffce5d0fe1d0e8a1f742e18c3df0cfa","operator_checks":["Run public smoke after deployment.","Verify MCP tools/list public contract.","Verify private MCP tools fail closed without a valid operator-issued key.","Run a valid private key probe before claiming private MCP readiness.","Record key id, scopes, limits and rotation date in the operator note."],"references":[{"name":"Product status","url":"/api/product-status"},{"name":"Public OpenAPI","url":"/api/openapi.json"}],"scope":"Read-only Model Context Protocol access to public 13FLOW resources, plus gated Pro tools that require an existing Pro API key or configured paid settlement path.","security":{"audit":"accepted, denied and rate-limited private API requests create audit rows","cache_policy":"Private API responses are private/no-store and vary by credential header","credential_headers":["Authorization: Bearer <token>","X-13FLOW-Key: <token>"],"x402":"implemented but disabled until production payment details are configured"},"surfaces":[{"auth":"none for public read-only tools","name":"public MCP","tools":["product.status","funds.list","funds.get","stocks.get"],"url":"/api/mcp"},{"auth":"operator-issued private API key; x402 path remains disabled","name":"Private MCP tools","tools":["pro.list_funds","pro.get_fund","pro.data_quality"],"url":"/api/mcp"}],"title":"13FLOW MCP methodology"}