A blocklet running on ARC exposes an MCP endpoint at /mcp and a set of discovery documents under /.well-known/. The runtime provides them; a blocklet does not opt in and cannot be deployed without them.
An agent that knows only the host URL can therefore reach the endpoint and list the available tools before any credential exists. What it can then read is decided by the blocklet, not by the runtime.
Three ways to connect
| Client can | Endpoint |
|---|---|
| Speak MCP | POST /mcp, streamable HTTP, stateless |
| Issue HTTP but has no tool-calling harness | POST /api/afs/rpc, the same operations as JSON-RPC |
| Only fetch text | GET /llms.txt, a pointer that names the other two |
All three serve the same data. Prefer /mcp when your client supports it.
Check the baseline first
Anonymous tools/list must work on every blocklet: no credential, no initialize, no session.
curl -s -X POST https://<host>/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'It answers with at least the eight generic AFS tools. If this fails, the problem is the host or the transport, not access. → Connect a client
Something already failed?
| What you got | What it means | Where |
|---|---|---|
401 with WWW-Authenticate | The method is not anonymous-safe, or your credential was rejected | Errors · Authorize a client |
200 with "isError": true and AFS_FORBIDDEN | The call reached the tool. The blocklet has not opened that path to network clients | Access tiers |
| Writes still refused with an owner credential | Expected. A credential is not a write switch | Access tiers |
tools/list returns only the eight AFS tools | The blocklet declares no content collections | Tools |
| Not sure you have the right host | GET /.well-known/mcp.json and check its url field | Discovery surfaces |
A 200 is not success. Check result.isError on every tools/call.
What decides whether a call succeeds
Four independent gates, decided by three different parties: the runtime, the blocklet, and the provider. A credential is an answer to the runtime, so it clears one gate and leaves the other three exactly where they were.
Gate 3 — what the blocklet declared for that path — is the one most agents hit, and no credential bypasses it, including an owner-role credential.
→ Access tiers for all four gates and why they are separate
Publishing a tool is not the same as allowing it
Anonymous tools/list publishes the write tools alongside the read tools. Calling one without a credential returns 401 with a challenge.
This is deliberate. A well-behaved MCP client only calls tools that were advertised to it, so hiding the write tools would mean the client never issues the request that produces the challenge. A challenge is what starts a standard authorization flow. Publishing the tools is what makes authorization discoverable.
Each blocklet issues its own credentials
The protected-resource document on a host names that same host as its authorization server. A credential obtained from one blocklet does not open another; it carries the instance it was issued for, and the runtime compares that instance on every call.
There is no cross-blocklet credential.
Where this board sits
AFS defines the paths, providers, and capability contract. This board is about reaching that contract from outside: which protocol surfaces exist on a host, how a client authenticates to them, and what a blocklet has to declare before an external caller sees anything.
If your question is "what does afs_read guarantee", read AFS. If it is "how does my agent get to call it", read on here.
Where to go next
| Connect | Connect a client · Claude Code and Codex CLI |
| Authenticate | Authorize a client · without a browser |
| Look something up | Errors · Endpoints · Understand the model |