NegativeEV bet checker

NegativeEV auth.md

NegativeEV (https://negativeev.com) is a bet checker. Anonymous visitors get a small number of free checks per day; signing in makes checks unlimited (paced by a per-hour cap). There is no separate agent API — agents use the same HTTP endpoints as the web app, under the same quotas and rate limits.

How auth works

• The authorization server is Supabase, not this origin. Its OIDC discovery metadata lives at https://bnmlyacvflqcwslhcxua.supabase.co/auth/v1/.well-known/openid-configuration and is mirrored at this origin for discovery: https://negativeev.com/.well-known/openid-configuration and https://negativeev.com/.well-known/oauth-authorization-server
• negativeev.com is the protected resource: it verifies Supabase-issued JWTs sent as Authorization: Bearer <access token>. Machine-readable resource metadata (RFC 9728): https://negativeev.com/.well-known/oauth-protected-resource
• Humans sign in with an email one-time code at https://negativeev.com/

What this means for agents

• There is NO autonomous agent registration: no dynamic client registration, no client_credentials grant, and no API keys. A register endpoint does not exist — don't look for one.
• An agent acts on behalf of a signed-in user: drive the site in the user's browser session, or send the user's Supabase access token as Authorization: Bearer on requests (including MCP tool calls).
• Anonymous access also works; the free daily quota is metered per device.

MCP server

A stateless MCP server (Streamable HTTP transport) is available at POST https://negativeev.com/mcp — server card at https://negativeev.com/.well-known/mcp/server-card.json

Tools: check_bet (grade a bet from text — spends one of the caller's checks when it fully grades), get_slate (is there a checkable slate right now — free), get_usage (checks remaining — free). Anonymous tool calls share the device's free daily quota; send a Supabase access token as Authorization: Bearer on the POST for unlimited checks (per-hour pace cap).

Endpoints agents may call

Same-origin JSON, quota- and rate-limited, not yet documented as a stable public API (shapes can change without notice):

• GET /slate — is there a checkable slate right now?
• POST /extract — parse a bet from text: {"text": "<bet text>"}
• POST /check — grade the parsed legs (send the fields /extract returned)
• GET /usage — checks remaining for the caller

A refused request (quota, rate limit, started game) returns an explanatory JSON error. Discovery: /.well-known/api-catalog, /sitemap.xml, and the agent-skills index at /.well-known/agent-skills/index.json