Static capability metadata for directory crawlers (Smithery et al).

Their scanners call tools/list over the transport, which is auth-gated, so they get a 401 and index nothing — the failure recorded in glama.md. Serving this card is the documented way past that WITHOUT opening /mcp to unauthenticated introspection: the 401 there is what starts OAuth discovery for real clients and must stay.

_mcp_http.tools is the same list the transport's own list_tools handler returns, so the card cannot drift from what an authenticated client sees. Tool names and schemas are public surface by intent; tools/call remains gated.

description and prompts come from the same two sources the transport uses, for the same reason. A crawler reading only this card is the first impression for most directories, and 53 tool names with no framing is not one — the prompts are what say who Iridium is for.