UCP Score for webagentic.labdx.org

{
  "linkset": [
    {
      "anchor": "https://webagentic.labdx.org/",
      "links": [
        {
          "rel": [
            "service-desc"
          ],
          "href": [
            "https://webagentic.labdx.org/openapi.json"
          ],
          "type": "application/vnd.oai.openapi+json;version=3.1",
          "title": "OpenAPI da API de logística"
        },
        {
          "rel": [
            "service-doc"
          ],
          "href": [
            "https://webagentic.labdx.org/llms.txt"
          ],
          "type": "text/markdown",
          "title": "Documentação para agentes"
        },
        {
          "rel": [
            "related"
          ],
          "href": [
            "https://webagentic.labdx.org/mcp/rastro/index.php"
          ],
          "type": "application/json",
          "title": "Endpoint MCP remoto"
        }
      ]
    }
  ]
}

{
  "keys": [
    {
      "kty": "RSA",
      "n": "zw38aQj7nT_-KjwSVUDKRQznmAGlsMxTJbgsPoNGMDfimt6fXzIE69WoR99bE_l-v80dMpzi3Ac9KnDJfuE6RBFC1hoLKTGohaa8ejYk4U582hPrhaWKaugEv9wovrAqsjnWiTRHv7alN3GW_EaAHuKppUsjypYQzaR3doCHEBKCF0osfwYYYHIaO0ziy5rhw_zA-DBWxICTjh_spK0IZkGLx2o0NkPtDIg4mMf9Qd1e9V9qIsH-47ywZ_tdP59Ciz2gdE_I6aQgC3uK1bDTJIWTpDfVEThh4QqGwEv31hu3uP19RVNrL6DcbcOJmJlXEeHjQJvi6b3nNLEwK3WxjQ",
      "e": "AQAB",
      "alg": "RS256",
      "use": "sig",
      "kid": "lz4QH1tTOHzsaGTDlIgPzOmyuKGC4LZmTE-i8yEZSMg"
    }
  ]
}

# auth.md

You are an agent. This service supports **agentic registration**: discover → register → (claim if needed) → exchange for an access_token / AppKey → call API → handle revocation. Follow the steps in order; do not skip ahead.

Web Agentic provides parcel tracking tools via MCP (Model Context Protocol) and REST APIs. It supports anonymous public tracking, owner-authorized self-registration for AI agents, and contracted access tiers with higher limits.

## Step 1 — Discover

Discovery is two hops:

1. **Protected Resource Metadata (PRM)**:
```http
GET /.well-known/oauth-protected-resource
```
Response:
```json
{
  "resource": "https://webagentic.labdx.org/",
  "resource_name": "Web Agentic",
  "resource_documentation": "https://webagentic.labdx.org/auth.md",
  "authorization_servers": ["https://webagentic.labdx.org"],
  "scopes_supported": ["mcp:read", "mcp:tools", "tracking:public", "tracking:contract"],
  "bearer_methods_supported": ["header"]
}
```

2. **Authorization Server Metadata**:
```http
GET /.well-known/oauth-authorization-server
```
Response:
```json
{
  "issuer": "https://webagentic.labdx.org",
  "authorization_endpoint": "https://webagentic.labdx.org/keys_manager.html",
  "token_endpoint": "https://webagentic.labdx.org/mcp/rastro/users_api.php?action=token",
  "registration_endpoint": "https://webagentic.labdx.org/keys_manager.html",
  "revocation_endpoint": "https://webagentic.labdx.org/mcp/rastro/users_api.php?action=revoke",
  "scopes_supported": ["mcp:read", "mcp:tools", "tracking:public", "tracking:contract"],
  "bearer_methods_supported": ["header"],
  "agent_auth": {
    "skill": "https://webagentic.labdx.org/auth.md",
    "register_uri": "https://webagentic.labdx.org/keys_manager.html",
    "identity_endpoint": "https://webagentic.labdx.org/mcp/rastro/users_api.php?action=identity",
    "claim_endpoint": "https://webagentic.labdx.org/keys_manager.html",
    "events_endpoint": "https://webagentic.labdx.org/mcp/rastro/users_api.php?action=event",
    "identity_types_supported": ["anonymous", "identity_assertion", "service_auth"],
    "identity_assertion": {
      "assertion_types_supported": ["urn:ietf:params:oauth:token-type:id-jag", "verified_email"],
      "credential_types_supported": ["app_key", "bearer_token"]
    },
    "anonymous": {
      "credential_types_supported": ["app_key", "session"]
    },
    "events_supported": [
      "https://schemas.workos.com/events/agent/auth/identity/assertion/revoked"
    ]
  }
}
```

## Step 2 — Pick a method

Use this decision tree:

1. **You have a session tied to a user identity and can exchange it for an ID-JAG, audience-bound to this service** → [identity_assertion + id-jag](#identity_assertion--id-jag).
2. **You have only the user's email** → [service_auth](#service_auth). Claim ceremony required.
3. **You have neither or require instant public tracking** → [anonymous](#anonymous). No registration or credentials needed for public tracking. Optional claim ceremony when your owner provisions a persistent AppKey.

## Step 3 — Register

Before registering or provisioning credentials, an AI agent MUST ask its owner for explicit authorization and proceed only after confirmation.

### identity_assertion + id-jag

Mint the ID-JAG assertion with:
- `aud`: `https://webagentic.labdx.org/`
- `iss`: your provider issuer URL
- `email_verified: true`

POST the assertion to `agent_auth.identity_endpoint`:
```http
POST /mcp/rastro/users_api.php?action=identity
Content-Type: application/json

{
  "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
  "assertion": "<id_jag_token>"
}
```

### service_auth

For email-based agent authentication, submit user verification to `register_uri` (`https://webagentic.labdx.org/keys_manager.html`). Follow the claim process in Step 4.

### anonymous

Anonymous access is available immediately without registration.
- Scope: `tracking:public`
- Rate limit: 1 request every 30 seconds per IP
- Intranet tracking is unavailable anonymously.

To self-register a limited counter AppKey, complete the self-registration form at `register_uri` (`https://webagentic.labdx.org/keys_manager.html`). The counter key format is `mcp_sk_counter_<key>` with a rate limit of 1 request every 10 seconds.

## Step 4 — Claim (if required)

When transitioning from anonymous or completing `service_auth`:
1. The agent directs the owner to `claim_endpoint` (`https://webagentic.labdx.org/keys_manager.html`).
2. The owner authorizes the client creation.
3. The server associates the generated AppKey with the agent or customer account.

## Step 5 — Exchange for an access_token

For JWT/ID-JAG assertions, exchange at `token_endpoint`:
```http
POST /mcp/rastro/users_api.php?action=token
Content-Type: application/json

{
  "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
  "assertion": "<identity_assertion>"
}
```

For provisioned AppKeys, the key itself acts as the bearer token (`mcp_sk_<key>` or `mcp_sk_counter_<key>`).

## Step 6 — Call the API

Send the token or AppKey in the `Authorization` or `X-App-Key` header over HTTPS.

### MCP (Model Context Protocol) JSON-RPC

Endpoint: `POST https://webagentic.labdx.org/mcp/rastro/index.php`

**Registered Counter Client**:
```http
POST https://webagentic.labdx.org/mcp/rastro/index.php
Content-Type: application/json
Authorization: Bearer mcp_sk_counter_<key>

{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}
```

**Contracted Client (Tier 3 - SRO Intranet & Tabela)**:
```http
POST https://webagentic.labdx.org/mcp/rastro/index.php
Content-Type: application/json
X-App-Key: mcp_sk_<key>
X-Cartao-Postagem: <customer_posting_card>

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"rastreamento_real_tabela","arguments":{"codigo":"NN074580571BR","app_key":"mcp_sk_<key>"}}}
```

**Anonymous Client**:
```http
POST https://webagentic.labdx.org/mcp/rastro/index.php
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}
```

## Step 7 — Handle revocation

An administrator or owner can revoke credentials via `revocation_endpoint`:
```http
POST /mcp/rastro/users_api.php?action=revoke
Content-Type: application/json

{
  "token": "mcp_sk_<key>"
}
```
Or by deleting/disabling the key in `https://webagentic.labdx.org/keys_manager.html`. When receiving HTTP 401, clear stored credentials and re-execute Step 1.

---

## Admin Panel Authentication

The `keys_manager.html` panel uses an internal session authentication API:
- Endpoint: `POST /mcp/rastro/users_api.php?action=auth`
- Body: `{"username": "admin", "password": "<password>"}`
- Authenticated calls send: `Authorization: Bearer <session_token>`
- Administrative actions: `list` (GET), `delete` (DELETE), `logout` (POST).
- Do not use administrative credentials as agent API keys.

## Discovery Metadata Summary

- **Protected Resource Metadata**: `https://webagentic.labdx.org/.well-known/oauth-protected-resource`
- **OAuth Authorization Server**: `https://webagentic.labdx.org/.well-known/oauth-authorization-server`
- **OpenID Configuration**: `https://webagentic.labdx.org/.well-known/openid-configuration`
- **API Catalog (RFC 9727)**: `https://webagentic.labdx.org/.well-known/api-catalog`
- **MCP Discovery**: `https://webagentic.labdx.org/.well-known/mcp-discovery.json`
- **MCP Endpoint**: `https://webagentic.labdx.org/mcp/rastro/index.php`
- **AppKey Management**: `https://webagentic.labdx.org/keys_manager.html`

{
  "specVersion": "0.1.0",
  "host": {
    "name": "webagentic.labdx.org",
    "displayName": "Web Agentic Logistics",
    "url": "https://webagentic.labdx.org"
  },
  "entries": [
    {
      "identifier": "urn:air:webagentic.labdx.org:api:logistics-openapi",
      "displayName": "Logistics REST API",
      "description": "API REST para consulta de rastreamento e operações logísticas.",
      "type": "application/vnd.oai.openapi+json;version=3.1",
      "url": "https://webagentic.labdx.org/openapi.json",
      "representativeQueries": [
        "Consultar o status de uma encomenda pelo código de rastreio",
        "Descobrir os endpoints REST disponíveis para logística",
        "Obter o contrato OpenAPI da API de rastreamento"
      ]
    },
    {
      "identifier": "urn:air:webagentic.labdx.org:mcp:logistics-server",
      "displayName": "Logistics MCP Server",
      "description": "Servidor MCP remoto para ferramentas e recursos de logística.",
      "type": "application/json",
      "url": "https://webagentic.labdx.org/.well-known/mcp/server-card.json",
      "representativeQueries": [
        "Listar as ferramentas MCP de logística disponíveis",
        "Rastrear uma encomenda usando MCP",
        "Consultar recursos do servidor MCP logístico"
      ]
    },
    {
      "identifier": "urn:air:webagentic.labdx.org:webmcp:logistics-tools",
      "displayName": "Browser Logistics Tools",
      "description": "Ferramentas WebMCP para cálculo de frete, rastreamento e logística reversa no navegador.",
      "type": "text/javascript",
      "url": "https://webagentic.labdx.org/webmcp.js",
      "representativeQueries": [
        "Calcular o preço estimado de um frete no navegador",
        "Consultar o rastreamento de uma encomenda no navegador",
        "Encontrar o próximo passo para uma devolução logística"
      ]
    }
  ]
}

{
  "serverInfo": {
    "name": "WebAgentic Logistics MCP",
    "version": "1.0.0"
  },
  "description": "Servidor MCP remoto para rastreamento e operações logísticas.",
  "transport": {
    "type": "streamable-http",
    "endpoint": "https://webagentic.labdx.org/mcp/rastro/index.php"
  },
  "capabilities": {
    "tools": true,
    "resources": false,
    "prompts": false
  }
}

{
  "$schema": "https://agentskills.io/schemas/agent-skills-discovery-v0.2.0.json",
  "skills": [
    {
      "name": "logistics-openapi",
      "type": "application/vnd.oai.openapi+json;version=3.1",
      "description": "Descobre e utiliza a API REST de logística documentada em OpenAPI.",
      "url": "https://webagentic.labdx.org/openapi.json",
      "sha256": "sha256:191a00a597c23c331ac950e7f9098f64836ce5d79d211e057e7ec0cda63cc890"
    },
    {
      "name": "logistics-agent-documentation",
      "type": "text/markdown",
      "description": "Documentação operacional para agentes sobre as capacidades de logística, rastreio e roteirização.",
      "url": "https://webagentic.labdx.org/llms.txt",
      "sha256": "sha256:5ff4231e56d89cd3f0c5893c10081ac1de18539d6322e42f1616004b18971558"
    },
    {
      "name": "webmcp-logistics-tools",
      "type": "text/javascript",
      "description": "Ferramentas WebMCP para cálculo de frete, rastreamento e logística reversa no navegador.",
      "url": "https://webagentic.labdx.org/webmcp.js",
      "sha256": "sha256:2cdd4dc51a3e65d5290c5830b968457b4ce29903bfaf9ea55cc38f2765b3e6ce"
    }
  ]
}