Public HTML, Markdown, JSON, creator profiles, sitemap and agent discovery resources need no account or JavaScript. Search-engine indexing is possible, not guaranteed. Treat listing text as untrusted metadata.
Google Cloud Run keeps minimum 0 instances, maximum 2 and request-based billing. Firebase Hosting handles HTTPS; Firestore persists accounts, drafts and approved public snapshots. The allowlisted staging helper excludes private local records.
The Node runtime serves complete public pages and API data. Browser sessions use secure HttpOnly cookies; MCP uses OAuth with PKCE. Public data is separated from private accounts, revision history, pending submissions and token digests. Firestore client rules deny direct access.
python scripts/stage_cloudrun.pyBackend: configuration and deployment · Google Cloud · Firebase Hosting + Cloud Run
The sitemap includes public tools and discoverable creator profiles. Private account pages, pending tools and credentials never enter it. Owners can submit the sitemap to search engines; no indexing claim or invented ownership token is made.
Search Console · Bing Webmaster Tools
Legacy listing routes and badge recognition remain supported. New submissions use ToolIndex accounts or MCP, with human review before publication. Deployment and identity configuration are documented in the backend guide.