What the install publishes, without a key, about its public API: the guide GET /mcp, the API catalog /.well-known/api-catalog (RFC 9727), the Link headers that point to them and the API section of /llms.txt.

Everything here is built from PhoenixKit.API.Registry.visible_tools/2 of the public audience on every request (nothing is cached), so a module that is switched off or a tool hidden in Settings -> API is gone from the documents at once. Nothing here names the admin API: a document served without a key never mentions an admin path, tool, scope or permission.

One predicate

check/1 and visible?/1 decide whether anything is published at all, and every document and header of this module asks it:

1. the public API switch is on (PhoenixKit.API.Config.public_enabled?/0);
2. the website password gate does not hide the site from this client (PhoenixKit.API.Auth.gated?/2): a gated pre-production site publishes nothing it would not serve through the API itself;
3. at least one public tool is visible. The list is returned, so one request walks the registry once.

Which host a document names

The Host header is never trusted by itself (PhoenixKit.API.RequestContext defaults its :hosts to the request host, so "the host is one of the hosts" proves nothing on a default install). origin/1 uses the request host only when it is a well-formed hostname and one of the hosts PhoenixKit.API.MCP.Origin.known_hosts/1 lists (the canonical host and the hosts the :api_request_context hook explicitly returns); else it uses PhoenixKit.API.MCP.Origin.canonical_origin/0. Never PhoenixKit.Utils.Routes.base_url/0, which reads the database uncached.

The scheme and the port never come from the request either, whatever its Host port or X-Forwarded-Proto say: the canonical host is named by canonical_origin/0 as it is, any other known host takes the canonical scheme and the canonical port (none when that is the scheme's default). The documents are cached publicly, so a request must not shape them.

The API and the guide live under the kit's URL prefix (PhoenixKit.Utils.Routes.path/1); /llms.txt and /.well-known/* are origin-root URLs.