{"ok":true,"kind":"crawlcheck-capability-registry-entry","v":1,"domain":"motherduck.com","page":"https://crawlcheck.io/registry/capabilities/motherduck.com","row":{"domain":"motherduck.com","host":"motherduck.com","report_id":"52hxtg2nou","scanned_at":"2026-10-04T05:20:34.217Z","manifest":"678d046c003364518e5d800b5b7782bdf791563e2e99431631186c876840dc24","declared":12,"protocols":["agent_skill","openapi"],"by_policy":{"identity":9,"metadata":3},"verified":0,"mismatches":0,"self_scan":false},"policy_classes":[{"id":"public_read_only","safety":"read_only_public","label":"Public read-only","automatic":true,"invoke":"May be called without credentials. CrawlCheck calls it only to check the declaration: GET with no input, on the scanned origin."},{"id":"authenticated_read_only","safety":"read_only_authenticated","label":"Authenticated read-only","automatic":false,"invoke":"Never called by CrawlCheck. An agent needs the user's own credentials and consent."},{"id":"reversible_write","safety":"reversible_write","label":"Reversible write","automatic":false,"invoke":"Never invoked automatically. Needs the owner's written authorisation and a test account."},{"id":"irreversible_write","safety":"irreversible_write","label":"Irreversible write","automatic":false,"invoke":"Never invoked automatically. Deletes or changes something that cannot be undone."},{"id":"financial","safety":"financial","label":"Financial","automatic":false,"invoke":"Never invoked automatically. Moves money or creates a charge."},{"id":"external_communication","safety":"external_communication","label":"External communication","automatic":false,"invoke":"Never invoked automatically. Sends a message, email or notification to someone."},{"id":"identity","safety":"identity_or_account","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},{"id":"unknown","safety":"unknown","label":"Unknown","automatic":false,"invoke":"Never invoked. Its effect cannot be read from the declaration, so it is treated as the riskiest case."},{"id":"metadata","safety":"metadata_only","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."}],"items":[{"capability_id":"cap1:41eecfd95fe72f011f15","protocol":"openapi","operation":"ducklings-getDucklingConfigForUser","method":"GET","endpoint":"https://api.motherduck.com/v1/users/{username}/instances","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":1,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “user”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:69b56a80eb936b7f9a02","protocol":"openapi","operation":"ducklings-setDucklingConfigForUser","method":"PUT","endpoint":"https://api.motherduck.com/v1/users/{username}/instances","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":2,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “user”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:341679aac8fe8186ccb4","protocol":"openapi","operation":"ducklings-getActiveAccounts","method":"GET","endpoint":"https://api.motherduck.com/v1/active_accounts","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":0,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “accounts”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:96f8ff2be5bbea4deab7","protocol":"openapi","operation":"users-createServiceAccount","method":"POST","endpoint":"https://api.motherduck.com/v1/users","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":1,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “users”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:4bcde77b6ddd952747dd","protocol":"openapi","operation":"users-delete","method":"DELETE","endpoint":"https://api.motherduck.com/v1/users/{username}","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":1,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “users”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:a854bf58f4d19e1f8c30","protocol":"openapi","operation":"users-listTokens","method":"GET","endpoint":"https://api.motherduck.com/v1/users/{username}/tokens","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":1,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “users”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:af254c23dd5e3b22dd4c","protocol":"openapi","operation":"users-createToken","method":"POST","endpoint":"https://api.motherduck.com/v1/users/{username}/tokens","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":2,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “users”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:f8667aae590812f1630c","protocol":"openapi","operation":"users-deleteToken","method":"DELETE","endpoint":"https://api.motherduck.com/v1/users/{username}/tokens/{token_id}","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":2,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “users”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:8ea9772f5d70620d6a9b","protocol":"openapi","operation":"dashboards-createEmbedSession","method":"POST","endpoint":"https://api.motherduck.com/v1/dives/{dive_id}/embed-session","declared":{"by":"https://motherduck.com/openapi.json","declaration_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","authentication":"http_bearer","params_required":2,"media":["application/json"],"safety_class":"identity_or_account","safety_basis":"its name contains “session”"},"policy":{"id":"identity","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"requires http_bearer: never called without the operator's own credentials"}},{"capability_id":"cap1:0d373e4c89236b0b18df","protocol":"agent_skill","operation":"llms-txt","method":null,"endpoint":"https://motherduck.com/.well-known/agent-skills/llms-txt/SKILL.md","declared":{"by":"https://motherduck.com/.well-known/agent-skills/index.json","declaration_sha256":"f7f9a2ed53aff73a9f53c278d719b5b80bcbaf6db6684e8a30dccac897711e38","authentication":"none","params_required":null,"media":null,"safety_class":"metadata_only","safety_basis":"an instruction file an agent reads; not an operation"},"policy":{"id":"metadata","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"metadata: describes a surface, is not itself an action"}},{"capability_id":"cap1:22a30d5b437196b92eea","protocol":"agent_skill","operation":"markdown-negotiation","method":null,"endpoint":"https://motherduck.com/.well-known/agent-skills/markdown-negotiation/SKILL.md","declared":{"by":"https://motherduck.com/.well-known/agent-skills/index.json","declaration_sha256":"f7f9a2ed53aff73a9f53c278d719b5b80bcbaf6db6684e8a30dccac897711e38","authentication":"none","params_required":null,"media":null,"safety_class":"metadata_only","safety_basis":"an instruction file an agent reads; not an operation"},"policy":{"id":"metadata","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"metadata: describes a surface, is not itself an action"}},{"capability_id":"cap1:3961e8083f6018f4991e","protocol":"agent_skill","operation":"api-and-mcp","method":null,"endpoint":"https://motherduck.com/.well-known/agent-skills/api-and-mcp/SKILL.md","declared":{"by":"https://motherduck.com/.well-known/agent-skills/index.json","declaration_sha256":"f7f9a2ed53aff73a9f53c278d719b5b80bcbaf6db6684e8a30dccac897711e38","authentication":"none","params_required":null,"media":null,"safety_class":"metadata_only","safety_basis":"an instruction file an agent reads; not an operation"},"policy":{"id":"metadata","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"metadata: describes a surface, is not itself an action"}}],"mismatches":[],"certificate":{"certificate_id":"ccap1:ce5cfa6a8c68eb468f93a5c6f9a8442d0c56829810fb0532652d11b5336f5537","certificate":{"kind":"crawlcheck-capability-certificate","v":1,"subject":"motherduck.com","domain":"motherduck.com","record":"52hxtg2nou","report":"https://crawlcheck.io/r/52hxtg2nou","manifest_sha256":"678d046c003364518e5d800b5b7782bdf791563e2e99431631186c876840dc24","measured_at":"2026-10-04T05:20:34.217Z","verification_checked_at":"2026-10-04T05:20:38.217Z","verification_policy":"public GETs with no required input and one read-only MCP tool with no required input, on the scanned origin only; redirects recorded, not followed","invocation_rule":"capabilities are read from declarations only; nothing is invoked. Later verification may call read_only_public operations alone; every other class needs the site owner's authorisation and a test account, and unknown is never called","counts":{"declared":12,"verified":0,"mismatches":0},"items":[{"id":"cap1:41eecfd95fe72f011f15","protocol":"openapi","operation":"ducklings-getDucklingConfigForUser","method":"GET","endpoint":"https://api.motherduck.com/v1/users/{username}/instances","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:69b56a80eb936b7f9a02","protocol":"openapi","operation":"ducklings-setDucklingConfigForUser","method":"PUT","endpoint":"https://api.motherduck.com/v1/users/{username}/instances","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:341679aac8fe8186ccb4","protocol":"openapi","operation":"ducklings-getActiveAccounts","method":"GET","endpoint":"https://api.motherduck.com/v1/active_accounts","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:96f8ff2be5bbea4deab7","protocol":"openapi","operation":"users-createServiceAccount","method":"POST","endpoint":"https://api.motherduck.com/v1/users","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:4bcde77b6ddd952747dd","protocol":"openapi","operation":"users-delete","method":"DELETE","endpoint":"https://api.motherduck.com/v1/users/{username}","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:a854bf58f4d19e1f8c30","protocol":"openapi","operation":"users-listTokens","method":"GET","endpoint":"https://api.motherduck.com/v1/users/{username}/tokens","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:af254c23dd5e3b22dd4c","protocol":"openapi","operation":"users-createToken","method":"POST","endpoint":"https://api.motherduck.com/v1/users/{username}/tokens","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:f8667aae590812f1630c","protocol":"openapi","operation":"users-deleteToken","method":"DELETE","endpoint":"https://api.motherduck.com/v1/users/{username}/tokens/{token_id}","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:8ea9772f5d70620d6a9b","protocol":"openapi","operation":"dashboards-createEmbedSession","method":"POST","endpoint":"https://api.motherduck.com/v1/dives/{dive_id}/embed-session","declared_by_sha256":"714d2ab8198f899d3e01e6ef90d72a516d76a7be683ea86b76a66b79c724433c","safety_class":"identity_or_account","policy":"identity","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:0d373e4c89236b0b18df","protocol":"agent_skill","operation":"llms-txt","method":null,"endpoint":"https://motherduck.com/.well-known/agent-skills/llms-txt/SKILL.md","declared_by_sha256":"f7f9a2ed53aff73a9f53c278d719b5b80bcbaf6db6684e8a30dccac897711e38","safety_class":"metadata_only","policy":"metadata","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:22a30d5b437196b92eea","protocol":"agent_skill","operation":"markdown-negotiation","method":null,"endpoint":"https://motherduck.com/.well-known/agent-skills/markdown-negotiation/SKILL.md","declared_by_sha256":"f7f9a2ed53aff73a9f53c278d719b5b80bcbaf6db6684e8a30dccac897711e38","safety_class":"metadata_only","policy":"metadata","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:3961e8083f6018f4991e","protocol":"agent_skill","operation":"api-and-mcp","method":null,"endpoint":"https://motherduck.com/.well-known/agent-skills/api-and-mcp/SKILL.md","declared_by_sha256":"f7f9a2ed53aff73a9f53c278d719b5b80bcbaf6db6684e8a30dccac897711e38","safety_class":"metadata_only","policy":"metadata","observed":"not_attempted","status":null,"observed_sha256":null}],"mismatches":[]},"signature":{"alg":"Ed25519","kid":"hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo","certificate_sha256":"ce5cfa6a8c68eb468f93a5c6f9a8442d0c56829810fb0532652d11b5336f5537","message":"the UTF-8 bytes of \"crawlcheck-capability-certificate-v1\\n\" followed by certificate_sha256 (hex), where certificate_sha256 = SHA-256 of the certificate as canonical JSON (keys sorted, no whitespace)","sig":"GSOCYysgTaVSGeMQ0Dt66_peilv9aJt0ze1_fBazsqPwK4Rtd9rkAfdZBQT92Jjrf7JZQJpu75FvXWU8-1Q4BA"},"issuer":{"name":"CrawlCheck observer","key":{"jwk":{"kty":"OKP","crv":"Ed25519","x":"Ny5tAiGdpyVWTm64G1_0g_sTo4ocLL7kqjZ6cK7G5KM"},"directory":"https://crawlcheck.io/.well-known/http-message-signatures-directory"}}},"verify":"https://crawlcheck.io/api/registry/capabilities/verify?domain=motherduck.com"}