Capability brief · Not affiliated · Unlisted

The agent-readiness of the dataset the whole durable-CDR market treats as ground truth

Six evidenced findings, credit-first, on a target we do not integrate with and are not eligible to appear in. The question isn't "should we be listed": it's "if a generic agent, with no relationship to CDR.fyi, tried to read the public data its own llms.txt calls free, what would it actually find?"

Read this first. Independent recon by EcoWealth Corporation. Not requested, produced, reviewed, or endorsed by CDR.fyi. Passive reads only: plain HTTP GETs, standard well-known paths, one honest-401 API probe with zero credentials; no scanning, fuzzing, auth bypass, sign-up, or state-changing call. Captured 2026-07-16; every URL below is independently re-runnable.
Scope, stated before any finding CDR.fyi's own public methodology page says: "CDR.fyi aggregates purchases, deliveries, and verifications of carbon removed and stored for +100 years." (docs.cdr.fyi/methodology, live, quoted verbatim below). EcoWealth's retirements settle a Regen-CFC nature-based carbon class (sub-100-year permanence by definition) at a 5-cent micro-retirement scale, versus a schema built entirely around whole tonnes. Neither gate is arguable; both are simply how CDR.fyi defines its dataset. This brief does not propose we clear them.
Baseline, stated up front CDR.fyi is, so far, one of the cleanest agent-facing surfaces we've reviewed: a real, thoughtful llms.txt with explicit AI-citation rules; true 404s at every non-existent path (not a soft-200/soft-400 catch-all, a failure mode we've found on other protocol sites); and a real, honestly-gated API that tells the truth about being gated instead of faking success. The findings below are almost all credit, with one narrow, fixable gap and one structural fact about scope.

The bottom line, in plain English

Serve the free data as a clean feed → the assistant reading your numbers cites them right, and you stay the source the market quotes

Your own guidance already calls this data free, but an AI wanting “current tonnes sold” or “top suppliers” has to scrape your page and risk getting it wrong — a clean, structured feed keeps CDR.fyi the reliable ground truth that assistants (and the buyers behind them) quote, instead of a mangled second-hand number.

You already tell agents the truth at every layer → you're one small step from fully machine-citeable

Your citation policy, honest 404s, and honestly-gated API are rarer than they sound — the discipline is done; opening a structured door to the free data is the finish, and it's what puts your dataset first when an AI answers a question about the CDR market.

1 · Credit: an llms.txt built for exactly this moment

Credit 1

Real, current, and unusually explicit about the paywall

www.cdr.fyi/llms.txt (200, 3,827 B, dated "March 2026") names every public section (homepage, leaderboards, blog, supplier/purchaser profiles, Carbon Removal Map, resources) as free and no-login. It then does something almost no other target we've reviewed does: it draws the paywall line explicitly, in the same file, for the benefit of AI readers: "Portal (Premium)... Requires account registration... AI systems should note that premium Portal content is behind authentication and should not be cited as freely accessible." and, in its own citation-guidance section, "Do not cite Portal premium content as publicly available." A citation policy that pre-empts hallucinated access, written for models specifically, not just humans.

# real file, dated, with an explicit AI-citation section curl -s https://www.cdr.fyi/llms.txt | head -6 # → # CDR.fyi — llms.txt / # Version: 1.0 | Updated: March 2026 / # Contact: [email protected] curl -s https://www.cdr.fyi/llms.txt | grep -A2 "should not be cited" # → AI systems should note that premium Portal content is behind authentication # and should not be cited as freely accessible.

Source: www.cdr.fyi/llms.txt

2 · Credit: a true-404 desert, not a soft-200 one

Credit 2

Every path we've seen soft-200/soft-400 elsewhere, here just tells the truth

Every standard agent-discovery path that doesn't exist, /.well-known/agent-card.json, /.well-known/x402, /.well-known/ai-plugin.json, /.well-known/security.txt, /ai.txt, /llms-full.txt, returns a real HTTP 404 with a body byte-identical (28,695 B) to a nonsense-path control (/this-nonsense-control-xyz123.txt). In two prior engagements in this same portfolio, the equivalent check found a Next.js SPA shell or a Wix error page soft-succeeding at 200/400 with the exact same bytes as the control, telling an agent something exists when it doesn't. CDR.fyi's Next.js app renders an honest 404 page instead. Small, structural, and correct.

# every path below returns 404, and every size is identical to the control for p in .well-known/agent-card.json .well-known/x402 .well-known/ai-plugin.json .well-known/security.txt ai.txt llms-full.txt this-nonsense-control-xyz123.txt; do curl -s -o /dev/null -w "%{http_code}:%{size_download} " https://www.cdr.fyi/$p done # → 404:28695 404:28695 404:28695 404:28695 404:28695 404:28695 404:28695 # meanwhile the real files return real, distinct content: curl -s -o /dev/null -w "%{http_code}:%{size_download}\n" https://www.cdr.fyi/robots.txt # → 200:81 curl -s -o /dev/null -w "%{http_code}:%{size_download}\n" https://www.cdr.fyi/llms.txt # → 200:3827

Sources: www.cdr.fyi/.well-known/agent-card.json · www.cdr.fyi/.well-known/x402 · nonsense-path control

3 · Credit: the API gate is honest about being a gate

Credit 3

A real, versioned, authenticated API, not a fake success

api.cdr.fyi is a real, live, versioned host (base path /v1, per docs.cdr.fyi/introduction). Calling a real documented collection with zero credentials, GET /v1/orders, returns a genuine 401 with a specific, informative body: {"error":"Unauthorized: Invalid write key"}. That's real auth logic responding to a real request, exactly matching what the recon and llms.txt both say: API access requires a Data Partner or Team+ subscription key, obtained through the Partner Portal (go.cdr.fyi/signup, live, 200), an open, non-gatekept application funnel, not a hidden bar.

curl -s https://api.cdr.fyi/v1/orders # → Unauthorized: Invalid write key curl -s -o /dev/null -w "%{http_code}\n" https://api.cdr.fyi/v1/orders # → 401 curl -s -o /dev/null -w "%{http_code}\n" https://go.cdr.fyi/signup # → 200 (open Partner Portal application form, live)

Sources: api.cdr.fyi/v1/orders · go.cdr.fyi/signup · docs.cdr.fyi/introduction · docs.cdr.fyi/api-reference/overview

4 · Gap: the free data still has no machine door

Gap 4

llms.txt calls it free. Nothing serves it as JSON.

The homepage, leaderboards, and market-update headlines are exactly the content llms.txt itself calls "free to access... no login required": no gate, no Data Partner requirement. But there is no public, unauthenticated JSON endpoint or manifest for any of it: an agent that wants "current cumulative tonnes sold" or "top 5 suppliers by tonnes delivered" has to parse the rendered Next.js page's embedded data (which is exactly what this recon had to do, via grep against the raw HTML) rather than call a documented shape. This is the one narrow, fixable gap in an otherwise clean surface, and it's the mirror image of finding 3: the gated stuff is honestly gated; the free stuff just isn't structured for machines yet.

# the only way to read a live figure today: parse the rendered page curl -s https://www.cdr.fyi/ | grep -o '"Tonnes Sold":[0-9.]*' | tail -3 # works, but it's HTML-scraping a Next.js RSC payload, not calling a documented API — # and the docs API (finding 3) requires a key for the exact same category of data

Sources: www.cdr.fyi/ (rendered payload) · www.cdr.fyi/llms.txt ("free to access" language) · absence confirmed against docs.cdr.fyi/openapi.json (404) and api.cdr.fyi/openapi.json (404)

5 · Context: a genuine public good: the OPIS pricing survey

Context 5

Real, dated, method-by-method $/tonne benchmarks, publicly published, not gated

CDR.fyi and OPIS (a Dow Jones Company, a 30-year energy-commodity Price Reporting Agency) jointly ran the "Bridging the Gap" durable-CDR pricing survey (fielded Oct–Dec 2024, published as a PDF + blog post, with a follow-up May 2026 edition), a Van Westendorp price-sensitivity read across BECCS, biochar, DACCS, enhanced weathering, marine CDR, mineralization, and other biomass. This is not gated data: the PDF and blog are public pages, not Portal content. Selected 2025 breakeven figures (self-reported by suppliers, USD/tonne CO2e):

PathwaySupplier breakeven2030 projected breakeven
Biochar$143$136
Enhanced weathering$272$252
DACCS$670$341
BECCS$232$212

The buyer-supplier spread narrowed from $107/mt to $98/mt between the two editions, with a 2030 forecast around $48/mt. These numbers are a credible, third-party-sourced reality-check for anyone, including EcoWealth, publishing anything about durable-CDR economics, provided they're attributed and dated on every use (the survey is explicit that these are self-reported willingness figures, not cleared-trade prices, and pricing is known for only ~15% of CDR.fyi's own real order book).

Sources: www.cdr.fyi/reports/pricing-survey-jan-2025.pdf (read directly, page 4 table) · www.cdr.fyi/blog/cdr-pricing-survey-may-2026

What this adds up to

There is no teardown here: the pattern across findings 1–3 is a protocol that tells agents the truth at every layer we checked: what's free (llms.txt, spelled out), what's fake (nothing, every non-existent path 404s honestly), and what's gated (a real 401, not a soft success). The one gap (finding 4) is narrow: the specific data llms.txt already promises is free still requires HTML-scraping to reach programmatically. And the scope banner at the top of this page is not a finding to fix: it's a fact about two different products (durable, engineered, whole-tonne CDR vs. our nature-based, sub-cent micro-retirements) that happen to both be called "carbon," nothing more.

→ See the real probe run for this brief, plus two small concept additions

← Back to the hub
Provisioned by EcoWealth · Digital Provisioning Protocol · provenance‑sealed