---
title: Discovery
description: How an agent finds POINTS. MCP endpoint, OAuth metadata, llms files, status.json, catalog.json, and the reference JSON.
url: https://thepoints.io/docs/agents/discovery
audience: [agents, developers]
---

# Discovery

> **Agent Pay status:** Approve does not execute. Execution: not enabled. ACH settlement: not enabled. prepare_payment never moves money. Machine-readable: [/docs/agents/status.json](/docs/agents/status.json).

Everything an agent needs to find and connect to POINTS is public, unauthenticated, and on `https://thepoints.io`.

## Connect

| URL | What it returns |
|---|---|
| `/mcp` | The MCP endpoint (Streamable HTTP). Without a token it returns HTTP 401 and a `WWW-Authenticate` header pointing to the protected-resource metadata. |
| [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource) | The resource (`https://thepoints.io/mcp`), its authorization server, and `scopes_supported` |
| [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server) | Authorization, token, registration, and revocation endpoints; PKCE `S256`; public clients only |
| [/.well-known/openid-configuration](/.well-known/openid-configuration) | The same authorization server metadata, for clients that look there |

Read the authorization, token, registration, and revocation endpoints from the metadata rather than hard-coding them.

## Read

| URL | What it returns |
|---|---|
| [/llms.txt](/llms.txt) | Index of the public site and docs for language models |
| [/llms-full.txt](/llms-full.txt) | Every public docs page and the changelog as one Markdown file |
| [/docs/agents/llms.txt](/docs/agents/llms.txt) | This section only |
| `/docs/<page>.md` | Any docs page as Markdown, for example [/docs/agents/quickstart.md](/docs/agents/quickstart.md) |

## Machine-readable state

| URL | What it returns |
|---|---|
| [/docs/agents/status.json](/docs/agents/status.json) | Agent Pay state, computed on each request: authorization, execution, `approveExecutes`, ACH settlement |
| [/docs/catalog.json](/docs/catalog.json) | Every POINTS product with its status |
| [/changelog.json](/changelog.json) | What shipped to production, by commit |
| [/docs/agents/reference/mcp-tools.json](/docs/agents/reference/mcp-tools.json) | MCP tools with scopes, annotations, and input schemas |
| [/docs/agents/reference/scopes.json](/docs/agents/reference/scopes.json) | OAuth scopes and the tools that need them |
| [/docs/agents/reference/statuses.json](/docs/agents/reference/statuses.json) | Status values and their meaning |
| [/docs/agents/reference/policy-vocabulary.json](/docs/agents/reference/policy-vocabulary.json) | Policy schema version, categories, matching rules, default caps |
| [/docs/agents/reference/errors.json](/docs/agents/reference/errors.json) | prepare_payment failure classes and protocol errors |

The reference JSON is generated from the same code the MCP server runs. A connected client can also call `tools/list` and `get_agent_pay_policy_vocabulary` for the live values on its connection.

Read `status.json` before telling a user what an approval does. Today it reports `"approveExecutes": false`.