The current LUCA Plus preview is https://luca-plus-agents-preview.pages.dev. It uses HTTP Basic Auth only for the landing routes / and /agents. The username is luca. Ask the site owner for the password. Send it over HTTPS, and do not put it in a URL, repository, or CLI argument.
| Route group | Access | Expected result without credentials |
|---|---|---|
/, /agents, /agents/, and landing file aliases |
Basic Auth | 401 with WWW-Authenticate |
/docs/, /skills/, /downloads/, static JS and CSS |
Public | 200 for existing files |
/llms.txt, /llms-full.txt, /agents.txt, /openapi.json |
Public | 200 |
/api/v1/* |
Public, 100 requests per IP per minute | Route response; no Basic Auth challenge |
POST /mcp |
Public, shares the API limit | JSON-RPC response for a valid request |
/sign-up/, /contact/ |
Public | Redirect to official LUCA site |
A valid /index.html request redirects to / after the same Basic Auth check. Encoded landing aliases receive the same check.
For the landing page, use a browser password prompt. For an HTTP check, send a Basic Auth header with the luca username. The Worker compares the complete credentials and returns Cache-Control: no-store. When PREVIEW_BASIC_AUTH_PASSWORD is missing, only the landing routes return 503. The secret is set in Cloudflare Pages or an ignored local .dev.vars file. There is no public API token or MCP password.
PREPRODUCTION=true sends X-Robots-Tag: noindex, noarchive on preview responses. The preview robots.txt allows crawlers to read public guides, docs, and tools. Search engines must not index these preview responses. The landing page still needs Basic Auth. Before public search discovery, LUCA must review claims, connect https://agents.lucaplus.com, and change the release indexing setting.
The MCP and event routes check the browser Origin header. The event route accepts only named actions and no personal data. The readiness route returns a result without storing its answers.
The API and MCP limit uses the Cloudflare client IP header. Each site allows 100 combined API and MCP requests in one fixed minute. The next request returns HTTP 429 and a Retry-After header. If the counter binding or client IP is unavailable, these routes return HTTP 503. Public documentation and downloads do not use this limit.