NegativeEV bet checker

NegativeEV auth.md

NegativeEV (https://negativeev.com) is a bet checker. Anonymous visitors get 10 free checks a day; signing in makes checks unlimited (paced by a per-hour cap). There is no separate agent API — agents use the same HTTP endpoints as the web app, under the same quotas and rate limits. The MCP server is the one exception: it is metered on its own counter, more generously (see below).

How auth works

• The authorization server is Supabase, not this origin. Its OIDC discovery metadata lives at https://bnmlyacvflqcwslhcxua.supabase.co/auth/v1/.well-known/openid-configuration and is mirrored at this origin for discovery: https://negativeev.com/.well-known/openid-configuration and https://negativeev.com/.well-known/oauth-authorization-server
• negativeev.com is the protected resource: it verifies Supabase-issued JWTs sent as Authorization: Bearer <access token>. Machine-readable resource metadata (RFC 9728): https://negativeev.com/.well-known/oauth-protected-resource
• Humans sign in with an email one-time code at https://negativeev.com/

What this means for agents

• There is NO autonomous agent registration: no dynamic client registration, no client_credentials grant, and no API keys. A register endpoint does not exist — don't look for one.
• An agent acts on behalf of a signed-in user: drive the site in the user's browser session, or send the user's Supabase access token as Authorization: Bearer on requests (including MCP tool calls).
• Anonymous access also works; the free daily quota is metered per device.

MCP server

A stateless MCP server (Streamable HTTP transport) is available at POST https://negativeev.com/mcp — server card at https://negativeev.com/.well-known/mcp/server-card.json

Tools: check_bet (grade a bet from text — spends one of the caller's checks when it fully grades), get_slate (is there a checkable slate right now — free), get_usage (checks remaining — free). Anonymous tool calls get their own per-device allowance of 100 checks a day — a separate counter from the web app's 10, so agent traffic never eats a browser's free checks. Send a Supabase access token as Authorization: Bearer on the POST for unlimited checks (paced at 1000 an hour).

Example prompts

Prompts a user can give any MCP-connected assistant to exercise the tools:

• "Is Shohei Ohtani over 1.5 total bases at -120 a good bet tonight?" — check_bet grades it against thousands of simulated games and returns the true probability, the implied probability from the price, and the edge.
• "Is there a checkable MLB slate tonight?" — get_slate answers per live sport, free, before any check is spent.
• "How many bet checks do I have left today?" — get_usage reports the remaining quota and when the next check frees up.
• "Here's my parlay: Ohtani over 0.5 home runs +280 and Dodgers moneyline -150. Worth it?" — check_bet prices each leg and the combined parlay.

Endpoints agents may call

Same-origin JSON, quota- and rate-limited, not yet documented as a stable public API (shapes can change without notice):

• GET /slate — is there a checkable slate right now?
• POST /extract — parse a bet from text: {"text": "<bet text>"}
• POST /check — grade the parsed legs (send the fields /extract returned)
• GET /usage — checks remaining for the caller

A refused request (quota, rate limit, started game) returns an explanatory JSON error. Discovery: /.well-known/api-catalog, /sitemap.xml, and the agent-skills index at /.well-known/agent-skills/index.json