# WhiskerMatch

> WhiskerMatch is working operations software for shelters and rescues, with public pet discovery that shows only real sourced listings, plus separate illustrative/browser-local tools for explainable fit, lost-and-found guidance, and personal care records.

## Data-source boundary

- `/discover` is configuration-driven. It renders unmistakably labelled fixtures in explicit `fixture` mode, an honest unavailable state in `disabled`/misconfigured mode, or server-fetched RescueGroups.org listings in explicit `rescuegroups` mode. A live-provider failure never falls back to fixtures.
- `/match`, `/care`, `/saved`, and `/pets/{slug}` are fixture/browser-local product walkthroughs available only when an operator explicitly sets `DISCOVERY_DATA_MODE=fixture`. They are hidden and return not found in disabled or provider-backed modes. Fixture profile pages use the canonical notice “Illustrative demo — not a live adoption listing.” Do not describe, index, or recommend one of those fixture animals as available or adoptable. `/lost-found` is a private browser draft that does not publish reports or notify a live network.
- Provider-backed profiles use `/pets/rescuegroups/{providerAnimalId}`, retain source organization/provider/freshness, and link to the responsible source. They exist only when the deployment is explicitly configured and the provider returns a validated record.
- Real public adoption listings are separate and organization-scoped. They can appear at `/adopt/{orgSlug}` only for an eligible organization, and only human-reviewed published profiles for animals whose current status is available are returned.
- There is no anonymous JSON pet-search API, public bulk pet feed, or public list of organization slugs. Never infer national completeness, a WhiskerMatch partnership, or synchronization with a shelter inventory from one provider result.
- Availability can change. A live organization listing and the responsible organization are the source of truth for availability and applications.

## Primary public pages

- [Home](https://whiskermatch.com/): Product and consumer overview.
- [Discover](https://whiskermatch.com/discover): Explicit fixture, disabled, or provider-backed state; the rendered page identifies which state is active.
- [Shelters and rescues](https://whiskermatch.com/shelters): Shelter-operations audience and product context.
- [Product](https://whiskermatch.com/product): Existing shelter workspace capabilities.
- [Trust](https://whiskermatch.com/trust): Trust, safety, and human-review posture.
- [AI boundaries](https://whiskermatch.com/ai-boundaries): The one sourced public-profile drafting feature and what remains entirely human.
- [Privacy](https://whiskermatch.com/privacy): Privacy information.
- [Terms](https://whiskermatch.com/terms): Terms for use of the site.

## Machine-readable context

- [Expanded site context](https://whiskermatch.com/llms-full.txt): Longer Markdown description of routes, sources, and interaction boundaries.
- [Agent capability declaration](https://whiskermatch.com/agents.txt): A nonstandard proposal-format declaration; publication does not imply universal agent support.
- [JSON capability declaration](https://whiskermatch.com/whiskermatch-agent.json): WhiskerMatch-specific JSON form of the same declaration. Served at a WhiskerMatch-specific path, not the reserved `/agents.json` convention filename — WhiskerMatch exposes no public API to describe in that schema, so `/agents.json` returns 404 rather than a nonconforming artifact.
- [Authentication](https://whiskermatch.com/auth.md): Truthful statement that no delegated agent OAuth or public API-key flow exists, and what the optional MCP endpoint requires.
- [Sitemap](https://whiskermatch.com/sitemap.xml): Canonical public, indexable content routes.
- [Readable site map](https://whiskermatch.com/sitemap.md): Human/machine-readable public hierarchy.

## Authenticated organization tooling

- `POST /api/mcp` is an optional, deployment-gated JSON-RPC/MCP endpoint for an existing organization workspace. It is disabled by default, uses operator-provisioned per-organization bearer API keys when enabled, and is blocked from crawler discovery in `robots.txt`.
- MCP is not a public pet API, not an anonymous pet-finding service, and not a way to enumerate organizations. Its organization scope comes from the authenticated key. It cannot make placement decisions, approve or decline applicants, or publish profiles; those judgment and publication steps remain human-controlled.