# Machine-readable reference

> Every fixed URL an agent can read to learn what IndexZero is and how to call it, without rendering a page.

Source: https://docs.indexzero.site/reference/machine-readable



Everything an agent needs to call IndexZero is published at a fixed URL. The documents are generated from the same constants the product enforces, so they cannot advertise a plan, a tool, or a scope the server does not have.

## Product-level documents [#product-level-documents]

| Document     | URL                                           | What it is                                                                                                                                   |
| ------------ | --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| llms.txt     | `https://indexzero.site/llms.txt`             | What IndexZero is for, when to use it and when not to, how to call it, cost and limits, and the tool groups. Per the llmstxt.org format.     |
| OpenAPI 3.1  | `https://indexzero.site/openapi.json`         | The MCP endpoint, the OAuth security schemes with named scopes, the API-key scheme, and the JSON error shape.                                |
| MCP manifest | `https://indexzero.site/.well-known/mcp.json` | Endpoint, transport, authentication schemes, scopes, tool groups, pricing, and links, in one JSON document. Also served from the app origin. |
| Tool catalog | `https://app.indexzero.site/api/mcp/catalog`  | Every tool with name, description, and JSON Schema for its arguments, in the shape function-calling APIs expect. Unauthenticated.            |
| Health       | `https://app.indexzero.site/api/health`       | `{ ok, service, env, database, timestamp }`. Unauthenticated.                                                                                |
| Sitemap      | `https://indexzero.site/sitemap.xml`          | Every public marketing page.                                                                                                                 |

The discovery documents are cacheable for five minutes with an hour of stale-while-revalidate, so a deploy that moves an endpoint propagates quickly.

## OAuth discovery [#oauth-discovery]

On the app origin, because the issuer and the resource live there. The marketing origin redirects these two paths rather than serving copies.

| Document                                 | URL                                                                 |
| ---------------------------------------- | ------------------------------------------------------------------- |
| Authorization server metadata (RFC 8414) | `https://app.indexzero.site/.well-known/oauth-authorization-server` |
| Protected resource metadata (RFC 9728)   | `https://app.indexzero.site/.well-known/oauth-protected-resource`   |

## This manual [#this-manual]

| Document             | URL                                         | What it is                                                                                   |
| -------------------- | ------------------------------------------- | -------------------------------------------------------------------------------------------- |
| Page index           | `https://docs.indexzero.site/llms.txt`      | Every page of this manual with its description.                                              |
| Whole manual         | `https://docs.indexzero.site/llms-full.txt` | Every page, concatenated.                                                                    |
| Any page as markdown | append `.md`                                | `https://docs.indexzero.site/credits.md` is the markdown for `/credits`. `/` is `/index.md`. |
| Content negotiation  | `Accept: text/markdown`                     | The same URL without `.md` answers with markdown when asked for it, with `Vary: Accept`.     |
| Sitemap              | `https://docs.indexzero.site/sitemap.xml`   | Every page here.                                                                             |

Every marketing page on indexzero.site also answers to `Accept: text/markdown`.

## Fetching the tool catalog [#fetching-the-tool-catalog]

```bash
curl https://app.indexzero.site/api/mcp/catalog
```

The response is a JSON array. Each entry has `name`, `description`, and `parameters` (a JSON Schema object for the tool's arguments). Descriptions state whether the tool costs credits, and the catalog also flags `costsCredits` and `readOnly` per tool, so a planner can budget before it connects.

## The MCP endpoint itself [#the-mcp-endpoint-itself]

```
https://app.indexzero.site/mcp
```

Streamable HTTP. `POST` sends a JSON-RPC 2.0 message; `GET` opens the server-to-client stream for an existing session (`Mcp-Session-Id` required); `DELETE` ends a session. Authenticate with an OAuth bearer token or an `iz_` API key. See [Any other client](/agents/other-clients) for a request that works from curl.