# Access Loomca with an agent

Loomca provides public product information and task guides. Public discovery
and tools do not grant account access, create assistants, or authorize purchases.
Use the target deployment's responses to verify availability; documentation alone
is not proof that an integration is running or supported by your agent client.

## Choose the interface

| Interface | Access | Scope |
| --- | --- | --- |
| WebMCP | A compatible browser visiting a public Loomca page | Product information, help search, article reading and public navigation. |
| Remote MCP | `POST /mcp`, anonymous | One fixed public-information tool; no browser or account required. |
| A2A | [Agent Card](/.well-known/agent-card.json), `POST /a2a` | Fixed public guidance, not customer assistants or account operations. |
| Administrative HTTP API | `/agent/v1`, authenticated | Only operations allowed by an owner-authorized, account-scoped credential. See [auth.md](/auth.md). |

Loomca currently presents web assistants. These public tools do not enable
WhatsApp, reservations, payments, admissions, or autonomous business commitments.
Account creation and login remain human-controlled. Never send credentials,
private source material or customer conversations to public tools.

## Public remote MCP

The endpoint is `/mcp` on this service's HTTPS origin. It implements a limited
MCP **2025-11-25 Streamable HTTP** interface with stateless JSON responses:

- `initialize` negotiates the protocol and advertises tools.
- `notifications/initialized` returns **202 Accepted**, with no response body.
- `ping` returns an empty result.
- `tools/list` advertises only `get_public_info`.
- `tools/call` with `{"name":"get_public_info","arguments":{}}` returns a fixed
  Spanish/English overview and public help, product and authentication links.
  It does not access accounts or call an AI provider.
- GET returns 405: no standalone SSE stream is offered. No sessions, session IDs,
  prompts, resources, subscriptions or client callbacks are advertised.

Each POST must use `Content-Type: application/json` and accept both
`application/json` and `text/event-stream`. After initialization, send the
negotiated `MCP-Protocol-Version: 2025-11-25` header. This deployment supports
JSON responses; accepting SSE is an MCP client transport requirement.

Requests are limited to 16 KiB and five seconds to receive their body.
Browser requests with a foreign `Origin` are rejected. Non-browser clients may
omit `Origin`; that does not authorize private operations. No OAuth issuer or
private bearer token is required for this public endpoint.

### Minimal client exchange

Set `LOOMCA_ORIGIN` to the target deployment's origin, such as
`http://127.0.0.1:8000` for a locally running backend. Use HTTPS in production.
Do not run account, checkout or chat operations during passive discovery.

```bash
curl "$LOOMCA_ORIGIN/mcp" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"public-guide-example","version":"1.0"}}}'

curl "$LOOMCA_ORIGIN/mcp" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-11-25' \
  --data '{"jsonrpc":"2.0","method":"notifications/initialized"}'

curl "$LOOMCA_ORIGIN/mcp" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-11-25' \
  --data '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

curl "$LOOMCA_ORIGIN/mcp" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-11-25' \
  --data '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"get_public_info","arguments":{}}}'
```

The result is public guidance, not a generated answer to an arbitrary question.
Read the linked current pages for prices, plan conditions and detailed instructions.

## Browser WebMCP

On supported public pages, a compatible browser can discover `get_public_info`,
`search_help`, `read_help_article` and `navigate_public` through its native
WebMCP API. Browser support varies. A client without that API can read the same
[public information](/sobre-loomca) and [help](/help), requesting
`Accept: text/markdown` when it prefers Markdown.

The browser `get_public_info` accepts public topic/language inputs. It is not
the same input schema as the remote MCP tool: discover each interface's schema
rather than reusing arguments. Public navigation does not submit login or signup
forms. No tools are exposed for private dashboards or customer chats.

## Other discovery and protected access

- [Public Agent Skill index](/.well-known/agent-skills/index.json): pointers and
  integrity metadata for the public guide, not installed client permissions.
- [Assistant directory](/.well-known/agents.json): approved public metadata for
  eligible web assistants. Follow `next` until `null`. A listed chat is not an
  MCP or A2A endpoint; domain restrictions describe its widget.
- [A2A Agent Card](/.well-known/agent-card.json): fixed public guidance only.
  Its JSON-RPC endpoint requires `A2A-Version: 1.0`; the card alone does not
  demonstrate successful execution.
- [API catalog](/.well-known/api-catalog): HTTP API documentation links. An
  OpenAPI operation is not an anonymous permission or an MCP tool.
- [Human-controlled authentication](/auth.md): account access, scoped management
  credentials and separately authorized commercial operations.
- [Public content index](/llms.txt): a convenience pointer, not an access-control
  mechanism or a guarantee of indexing, discovery or tool-selection priority.

Use only approved public content as AI input; no training permission is granted.
This permission does not extend to private accounts, Teams, sources or conversations.