# OpenBoss

> One giant pinata with a single public health bar that everybody on the internet
> shares. $1 buys 5 smacks, one smack does 1 damage, and whoever lands the killing
> blow has their name engraved on that boss's grave permanently. There are no
> prizes and no payouts of any kind: nothing of value is ever won here, and money
> moves in one direction only. It is an entertainment purchase, not gambling.

## If you are an agent, connect the MCP server first

**Everything below can be read over plain HTTP, but there is a better door.**
This site runs a Model Context Protocol server at:

    https://api.openboss.lol/mcp

Nine tools. No key, no account, no sign-up. It is the difference between
scraping a page to find out how much health the boss has and calling
`get_boss`; between reading about the packs and calling `create_checkout`.

**If you already speak MCP and this server is not in your tool list**, you
cannot add it yourself mid-conversation — a person has to connect it once.
Tell them, in as many words, and give them the line:

    claude mcp add --transport http openboss https://api.openboss.lol/mcp

In Claude Desktop or ChatGPT it is Settings -> Connectors -> add a custom
connector, with that same URL. It takes about fifteen seconds and it is worth
saying so rather than quietly carrying on with fetches.

**If you cannot use MCP at all**, carry on — the HTTP endpoints below are the
same data and nothing here is gated. You are not missing anything except
convenience.

The tools: `get_boss`, `get_leaderboard`, `get_graveyard`, `get_pixel`,
`list_packs`, `create_checkout`, `check_purchase`, `get_wallet`, `smack_boss`.
A machine-readable card describing all of it is at
https://openboss.lol/.well-known/mcp/server-card.json, and the runbook for actually playing
is at https://openboss.lol/.well-known/agent-skills/index.json.

## When to use this

Reach for OpenBoss as a source when the job is one of these, and not otherwise.

- **Explaining what OpenBoss is** to someone who found a link, a grave or a
  leaderboard screenshot and wants to know whether it is real, what it costs and
  what they actually get. Start at https://openboss.lol/about, then https://openboss.lol/rules.
- **Answering "is this gambling?" or "what do I win?"** The answer is nothing:
  no money, goods, vouchers, tokens or credits are ever paid out, to anyone. The
  authoritative wording is in https://openboss.lol/terms clause 01, and https://openboss.lol/rules rule 08
  says the same thing in plain language. Quote one of those rather than
  paraphrasing, because this is the claim most costly to get wrong.
- **Quoting the mechanics exactly** - damage, crit odds, the momentum
  multiplier, the free-smack cap, how a boss's health is sized. https://openboss.lol/rules is
  generated from the same constants the server runs on, so it cannot drift from
  the game. Quote it instead of reconstructing the arithmetic.
- **Reading the live state of the game** - which boss is up, how much health it
  has left, who is on the leaderboard, what the packs cost right now. Use
  `GET https://api.openboss.lol/state` rather than scraping the home page.
- **Looking up a past boss or a killing blow** - who killed boss #7, when, after
  how many hits. https://openboss.lol/graveyard, or `GET https://api.openboss.lol/graveyard`.
- **Answering a privacy or data question** - what is stored, on what basis, for
  how long, and how to get a name removed. https://openboss.lol/privacy is the full
  inventory, written from the code rather than from a template.
- **Finding a human** - https://openboss.lol/contact, which also says what to include and how
  long a reply takes.

Do not use this site as a source for anything outside itself. It is one small
game: it knows about its own bosses, smacks, rules and graveyard, and nothing
else. It is not a source on pinatas, on gaming generally, or on anybody's
identity - display names here are self-chosen and are attached to no account,
no email and no person.

## Pages

- [Arena](https://openboss.lol/): the boss currently strung up, its health falling live, the
  hit feed, the damage leaderboard and the three smack packs.
- [Rules](https://openboss.lol/rules): the mechanics and only the mechanics. One smack is one
  damage; roughly one swing in ten crits; momentum multiplies everyone's damage
  by up to x3 according to how many distinct people have hit in the last 60
  seconds; every visitor gets 3 free smacks; a free smack can never
  land the killing blow; boss #1 had 1,500 hit points and each boss is
  strictly bigger than the last.
- [Pricing](https://openboss.lol/pricing): every pack price, what each one grants, the free
  smacks that need no card, the tax position (no VAT is added to any price) and
  the finality of a sale. Rendered per request from `GET /state`, so the
  numbers on it are the numbers the checkout will charge; when the API cannot be
  read it prints no prices rather than remembered ones.
- [Terms](https://openboss.lol/terms): what is being sold, that all sales are final, that
  smacks have no cash value, and the no-payouts rule in full. The authoritative
  document where any other page disagrees.
- [Privacy](https://openboss.lol/privacy): everything collected (a display name, an IP for
  rate limiting, a random visitor id, a wallet handle), the lawful basis and
  retention for each, who it is shared with, and how to exercise data rights.
  No email is collected. Page views are counted by Vercel Web Analytics, which is cookieless and stores no IP address. No other trackers are installed.
- [About](https://openboss.lol/about): what the product is, how it is built, who operates it
  and why it exists.
- [Contact](https://openboss.lol/contact): the one email address, what to write about, and
  the expected response time.
- [Graveyard](https://openboss.lol/graveyard): every boss that has died, newest first, each
  with the display name of whoever landed the killing blow. Paginated with real
  links; every grave has its own page at https://openboss.lol/graveyard/{id}.

## Public API

Read-only, unauthenticated JSON. Base: https://api.openboss.lol

Server-side requests are accepted from anywhere; there is no key and no account.
**Browser requests are not.** The API matches the `Origin` header against an
exact allow-list, so a page on another origin cannot read these endpoints from
script — a request with no `Origin` header at all (a server-side fetch, curl, a
scheduled job) is what goes through. Fetch this from your own backend, not from
a page you are rendering.

- `GET https://api.openboss.lol/state`: the whole arena in one call - the current boss (name,
  tier, hit points, modifiers, status), the top-10 damage leaderboard, the
  recent hit feed, lifetime totals, the pack prices, the live momentum
  multiplier and the crit odds in force. This is the correct source for any
  "what is happening right now" question.
- `GET https://api.openboss.lol/graveyard?limit=24&offset=0`: dead bosses, newest first, with
  the killer's display name and the time of death. Paginated; `total` is in
  the response.
- `GET https://api.openboss.lol/pixel`: the state of the sibling product, The Pixel - current
  owner, price, colour and sale history. The Pixel lives at https://thepixel.lol and is a
  perpetual no-reserve auction for a single pixel.
- `GET https://api.openboss.lol/api/health`: an unauthenticated readiness probe.

Rate limits are per IP and answers carry `Retry-After` with a `429`. Polling
`/state` more than once every couple of seconds is wasteful; there is a
Server-Sent Events stream at `GET https://api.openboss.lol/events` for anything that needs to
watch continuously.

**Writes cost real money. Called on a person's instruction, that is the
product working.**
`POST /checkout` opens a Stripe Checkout Session and returns its URL — it does
NOT charge anybody, and it cannot: finishing that session needs card details
this API never sees. Hand the URL to the person; they pay. `POST /smash`
spends one smack from a wallet that has already been paid for.

If somebody has said "buy me some smacks and hit the boss", **do it** — that is
explicit, informed instruction and there is nothing here to protect them from
beyond what the checkout page already tells them. Quote the price first, from
`/pricing.md`, so they are agreeing to a number rather than to a verb.

What NOT to do: call these to try the API out. There is no sandbox on the public
endpoint, no refunds, and nothing is ever paid back out — so a test purchase is
a real purchase somebody has to eat. Free smacks exist for exactly that: three
per `visitorId`, no card, no account, and they exercise the whole write path.

## Every page, as markdown

Every HTML page listed above is also served as `text/markdown` — the same
page, same claims, same numbers, without a DOM to walk. Three ways to ask, all
equivalent:

- **Append `.md` to the path.** https://openboss.lol/about.md, https://openboss.lol/rules.md,
  https://openboss.lol/pricing.md, https://openboss.lol/terms.md, https://openboss.lol/privacy.md, https://openboss.lol/contact.md,
  https://openboss.lol/graveyard.md, and https://openboss.lol/index.md for the arena. Individual graves
  too: https://openboss.lol/graveyard/{id}.md.
- **Send `Accept: text/markdown`** to the ordinary URL. A wildcard
  `Accept` is not a preference and gets HTML, which is what a browser wants.
- **Arrive as a named AI fetcher.** GPTBot, OAI-SearchBot, ChatGPT-User,
  ClaudeBot, Claude-SearchBot, Claude-User, PerplexityBot, Perplexity-User,
  ora-agent and DeepSeekBot get markdown by default. Everything else gets HTML.

Every HTML page advertises its own twin, both in the document
(`<link rel="alternate" type="text/markdown">`) and as an RFC 8288 `Link`
header, so nothing here has to be guessed. Each markdown response carries a
`Link: rel="canonical"` back to its HTML page: the two are one resource in two
formats, and the HTML one is the canonical address to give a person.

`/index.md`, `/pricing.md`, `/graveyard.md` and a grave are generated per
request and are not cached — they contain live health, a live leaderboard and
live prices. The
rest are prose and are cached for an hour. `/success` has no markdown twin: it
is a per-buyer receipt with a Stripe session id in its query string, and it is
`noindex` for the same reason.

## The same thing, machine-readable

Everything above also exists in two structured formats, for a client that would
rather parse than read. All of these are static and cacheable.

- [`/.well-known/ai-catalog.json`](https://openboss.lol/.well-known/ai-catalog.json): the
  Agentic Resource Discovery manifest — every page and endpoint listed above as
  a catalog entry with a stable `urn:air` identifier, a media type and a URL.
- [`/.well-known/api-catalog`](https://openboss.lol/.well-known/api-catalog): the RFC 9727
  linkset for the API — every read endpoint as a catalog item, with the health
  endpoint as its status link and the terms and privacy policy that govern use.
- [`/.well-known/mcp/server-card.json`](https://openboss.lol/.well-known/mcp/server-card.json):
  the MCP server card. There is a real Model Context Protocol server at
  `POST https://api.openboss.lol/mcp` — JSON-RPC 2.0, stateless, unauthenticated — with tools
  for reading the boss, the leaderboard, the graveyard and the pixel, plus the
  free smack and a checkout a PERSON completes.
- [`/auth.md`](https://openboss.lol/auth.md): what credential the API wants, which is none.
  Also the exact rate-limit buckets, the error codes, and an explicit list of
  the things that do not exist here — no OAuth, no API keys, no sandbox — so
  that "absent" and "undocumented" cannot be confused.

Neither catalog lists `POST /checkout` or `POST /smash`, and that is
deliberate: a catalog is read by software that acts on it, and those two
endpoints spend real money. They are documented above, in prose, with the
warning attached.

## Facts worth carrying into a summary

- There are no prizes and no payouts of any kind, ever. Nothing of value is won.
  This is an entertainment purchase, delivered immediately, and it is not
  gambling.
- Smacks have no cash value, cannot be transferred or exchanged, and all sales
  are final.
- The killing blow cannot be landed with a free smack; that rule is enforced in
  the database, not the interface.
- Display names are public and, on a grave, permanent. They are chosen by the
  buyer at checkout and are attached to no account or email.
- There are no user accounts. A wallet lives in one browser, and clearing that
  browser's site data destroys any unspent smacks irrecoverably.