agentic.anchorage.com with no account can read what
the product offers and search the service catalog. Both answers come from
files and an endpoint served at the domain root, so an agent author can point
a client at the host and let it read the rest for itself.
Index at the domain root
agentic.anchorage.com/llms.txt describes this host for an agent in the
llms.txt format: a short summary of what Anchorage
Agentic Banking does, then a linked list of the paths an agent uses. It names
the catalog endpoint, the authenticated endpoint that holds the wallet and
payment actions, the public API description, and this documentation site.
An agent reads it before it has a token, which makes it the entry point for a
client that knows only the hostname.
Searching the catalog without an account
agentic.anchorage.com/public-mcp answers catalog queries over MCP without
authentication. An agent describes what it needs in plain words and gets back
the matching merchant services, each with its name, description, tags, owning
merchant, and the payment methods it accepts. Given one of those services, the
agent can pull its endpoint URLs and the merchant’s API and documentation
links.
This route runs without a session. Results span every network and endpoints
come back unfiltered, which leaves the agent two things to check. Pick the endpoint on the network you intend to transact
on. And read the payment methods before treating a service as payable, because
a service with no live endpoint still matches a search here and reports none.
Searching is how an agent finds a service. Walking the site does not work,
because the catalog pages render results for a query rather than listing every
service.
The same catalog is available to a connected agent, scoped to the network that
agent is pinned to. That scope is what drops the services this route keeps. See
finding merchants to pay for what a
connected agent gets back.
Registering a wallet, checking a budget, and paying for a service need a
connected agent. Those actions live behind the authenticated endpoint, which
answers an unauthenticated request with a 401 and a header naming the
metadata a client needs to start the sign-in flow. See
connect an agent to link a client.
What crawlers may read
agentic.anchorage.com/robots.txt names the public paths a crawler may read
and denies everything else. The file itself is the list, so read it there
rather than relying on a copy. It covers the landing page, the public
paths named in the agent index, the merchant search page with its service and
merchant detail pages, and the styles, webfonts, and favicon the landing page
needs to render. The agent index also names
the authenticated endpoint, which stays denied because a crawler without an
OAuth session gets a 401 there.
Denying the rest is deliberate. Almost every other path requires a session and
answers a signed-out request with a sign-in page, so a crawler let loose on
the host would collect thousands of near-identical sign-in pages.
A crawler reading the policy the way RFC 9309 describes therefore indexes the
pages meant to be public and skips the sign-in redirects. Some older crawlers
read the rules more narrowly and skip the public pages as well. That costs
those crawlers a listing rather than exposing anything, and an agent fetching
/llms.txt or the catalog endpoint directly is unaffected either way.