# DoNotAge agent guide

> DoNotAge sells its products and the DoNotAge Routine on this site, with research, articles and support in 10 languages. This guide says what an AI agent can do here today, how it connects, and what it cannot do. The capability registry is authoritative for this deployment.

## Read the shop

Public pages need no account and no credential: the products, the DoNotAge Routine, articles, research and the support and policy pages. The curated list of them, in every language, is at https://donotage.org/llms.txt

The homepage and published articles also answer in Markdown. Send `Accept: text/markdown` to the page's own address, or add `/index.md` to its path. Every other page answers in HTML only, and the HTML page stays the canonical one.

```bash
curl -s -H 'Accept: text/markdown' https://donotage.org/
```

Prices depend on the Market a visitor shops in, which sets the currency. What each Market sells, and at what price, is read from the live catalogue at https://donotage.org/pricing.md

People buy on the website itself: the DoNotAge Routine and the shop's products share one cart, a one-off purchase works as a guest, checkout quotes delivery for the address, and members manage their subscriptions in My Account.

## Find the agent interfaces

The capability registry is the authoritative list of the agent operations this deployment supports, with each one's state and the scopes it needs. It needs no credential:

```bash
curl -s https://donotage.org/agent/v1/capabilities
```

Every discovery document is public:

- API catalog: https://donotage.org/.well-known/api-catalog
- OpenAPI description of the HTTP agent API: https://donotage.org/openapi.json
- OAuth authorization server metadata: https://donotage.org/.well-known/oauth-authorization-server
- Protected resource metadata, HTTP agent API: https://donotage.org/.well-known/oauth-protected-resource
- Protected resource metadata, MCP: https://donotage.org/.well-known/oauth-protected-resource/mcp
- MCP server card: https://donotage.org/.well-known/mcp/server-card.json
- A2A agent card: https://donotage.org/.well-known/agent-card.json
- Agent Skills index: https://donotage.org/.well-known/agent-skills/index.json
- ARD manifest: https://donotage.org/.well-known/ard.json

## Connect over MCP

The MCP server uses the Streamable HTTP transport, protocol versions 2026-07-28 and 2025-06-18, at https://donotage.org/mcp

Connecting, listing its tools and calling its public tools (`commerce_capabilities_read`, `commerce_catalog_search`, `commerce_product_read`, `commerce_routine_read`, `commerce_delivery_read`, `commerce_cart_link_create`) need no credential. Calling any other tool needs an OAuth bearer token issued for that exact resource with the `agent:read` scope (see Authentication for who can obtain one). Without one the server answers that call with 401 and a WWW-Authenticate challenge that names its protected resource metadata. Anonymous calls of the public tools are rate-limited per address; over the limit the server answers 429 with Retry-After. Its tools:

- `commerce_capabilities_read` reads the capability registry. It is public: it needs no credential, and with a token it needs `agent:read`. A host that supports MCP Apps can show its result in the view `ui://donotage/capabilities`, an HTML page of the same registry, which can be listed and read without a credential.
- `commerce_catalog_search` searches the Shop's products by need, ingredient or name and answers each one's page, its variants' prices in one store's currency and whether they are in stock. It is public. Give the person's country (or a store) to quote prices; the basket confirms them.
- `commerce_product_read` reads one product by its handle in one store: its authored description and page, each variant's price, stock and ways of buying (once, or on a yearly subscription of its own, with what that charges each year), a bundle's contents and saving, and the plans a basket link may carry. It is public.
- `commerce_routine_read` reads the DoNotAge Routine, sold by subscription on its own page, in one store: each way of buying it (its pouch every 4 weeks, a year's pack once or on a yearly subscription) with what each charge costs, its stock, the plan a basket link carries for each, and the add-ons sold beside it. It is public.
- `commerce_delivery_read` says whether DoNotAge delivers to a country and what standard delivery costs there: the price, the order value from which it is free, and the price for qualifying Routine or Performance One-A-Day 4-week pouch subscriptions. Yearly plans use standard terms. With Shop items, the whole basket uses standard terms wherever the subscription delivery price is nonzero; zero stays free. It is public; checkout confirms the figures.
- `commerce_cart_link_create` checks chosen SKUs, quantities and plans against one store and answers a link that fills the basket of whoever opens it, naming any item left out and why. It is public, stores nothing and adds no partner code; the person checks out and pays on the site.

A client that speaks protocol 2025-06-18 can list the tools in one stateless request:

```bash
curl -s -X POST -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-06-18' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
  https://donotage.org/mcp
```

## Help a person shop

With the public MCP tools alone, an agent can take a person from a question to a filled basket. Pass the country the order is delivered to as `country` on each call: without it nothing is priced.

- `commerce_catalog_search`: find products by need, ingredient or name, with their handles.
- `commerce_product_read`: read a product's variants, prices, stock and ways of buying.
- `commerce_routine_read`: read the DoNotAge Routine's ways of buying, what each charge costs, and its add-ons.
- `commerce_delivery_read`: say whether DoNotAge delivers there and what standard delivery costs.
- `commerce_cart_link_create`: make the basket link and give it to the person. They check out and pay on the site, which confirms prices, discounts and delivery.

The Agent Skills index lists the shop-for-a-person skill, which gives the same steps: https://donotage.org/.well-known/agent-skills/index.json

Quote only what the tools answer: write no health claims of your own, claim a saving only where a tool states one (a sale's price before it, a bundle's saving), and never add a partner code to a link.

## Connect a command-line client

DoNotAge publishes no SDK or command-line package of its own: any MCP client that speaks Streamable HTTP connects to https://donotage.org/mcp

Its maker publishes Claude Code on npm: https://www.npmjs.com/package/@anthropic-ai/claude-code

```bash
npm install -g @anthropic-ai/claude-code
claude mcp add --transport http donotage https://donotage.org/mcp
```

Added this way, Claude Code connects, lists the tools and calls the public ones, which need no credential: `commerce_capabilities_read`, `commerce_catalog_search`, `commerce_product_read`, `commerce_routine_read`, `commerce_delivery_read`, `commerce_cart_link_create`. A client added without a credential cannot call any other tool: the server answers that call with 401, and this issuer offers no dynamic client registration for the client to sign in with.

To call the other tools, put a bearer access token for exactly that endpoint in `DNA_MCP_TOKEN` (see Authentication). The token is short-lived and neither client refreshes it: once it has expired, the server refuses every request that carries it, connecting and listing included, so export a new one and start the client again.

Claude Code calls every tool with the token when it is added with this command instead (run `claude mcp remove donotage` first if you added the server with the command above). Keep the single quotes: Claude Code then stores the variable's name, not the token, and reads `DNA_MCP_TOKEN` from the environment it was started in.

```bash
claude mcp add --transport http donotage https://donotage.org/mcp --header 'Authorization: Bearer ${DNA_MCP_TOKEN}'
```

The Codex CLI reads `DNA_MCP_TOKEN` when it starts. Its maker publishes it on npm: https://www.npmjs.com/package/@openai/codex

```bash
npm install -g @openai/codex
codex mcp add donotage --url https://donotage.org/mcp --bearer-token-env-var DNA_MCP_TOKEN
```

The Agent Skills index lists the connect-mcp-cli skill, which gives the same connections.

## Talk A2A

The A2A 1.0 JSON-RPC endpoint is https://donotage.org/a2a and its agent card is https://donotage.org/.well-known/agent-card.json

It answers each message directly and creates no tasks; streaming and push notifications are not supported. The capability read needs no credential:

```bash
curl -s -X POST -H 'Content-Type: application/json' -H 'A2A-Version: 1.0' \
  -d '{"jsonrpc":"2.0","id":"capabilities","method":"SendMessage","params":{"message":{"messageId":"capabilities-1","role":"ROLE_USER","parts":[{"data":{"operation":"commerce.capabilities.read"},"mediaType":"application/json"}]}}}' \
  https://donotage.org/a2a
```

## Authentication

Public pages, the discovery documents and the capability registry need no credential. Everything else uses OAuth 2.0 tokens from this shop's own authorization server, each bound to exactly one resource. The complete, current description is at https://donotage.org/auth.md

Machine clients are confidential OAuth clients whose credentials the DoNotAge operator issues out of band. They use the client credentials grant with HTTP Basic authentication, ask for `agent:read` and name one resource: the origin itself for HTTP and A2A, or the MCP endpoint for MCP.

```bash
curl -s -u "$DNA_CLIENT_ID:$DNA_CLIENT_SECRET" \
  -d grant_type=client_credentials \
  --data-urlencode 'scope=agent:read' \
  --data-urlencode resource=https://donotage.org/mcp \
  https://donotage.org/oauth/token
```

Codex connects to an existing member account, which the member signs in to and approves in the browser, with the authorization code grant and PKCE S256 as the public `codex-cli` client:

```bash
codex mcp add dna \
  --url https://donotage.org/mcp \
  --oauth-client-id codex-cli \
  --oauth-resource https://donotage.org/mcp
codex mcp login dna --scopes agent:read,offline_access
```

Agents cannot register themselves or create an account here: there is no dynamic or self-service registration, and no agent credential can read a member's account.

Other hosted clients, such as ChatGPT, Claude or Gemini connections, have not been verified against this server.

## What agents cannot do here

- Complete a purchase through an agent interface. An agent hands the person a basket link, and they buy on the website.
- Change anything in a member's account. No agent operation changes a subscription, an address, a payment method or an order.
- Read a member's account. No agent credential can in this deployment.
- Use UCP. It is not exposed.

## Rules for agents

- Follow the crawler rules and the Content-Signal preferences at https://donotage.org/robots.txt
- Treat account, cart and checkout pages as private. They are excluded from crawling, and a member's data is reachable only through the credentials above.
- Identify your agent with a descriptive User-Agent.
- Never put a client secret or an access token in a URL.
- Quote a price only with its Market and the time it was read. The cart and checkout state the amount that is paid.

This guide is also published as an HTML page at https://donotage.org/docs