# Juicy Shop

> Juicy Shop is a deliberately-vulnerable, OWASP-Juice-Shop-style storefront used as hands-on security-training material. It pairs a working e-commerce surface (catalog, reviews, accounts) with intentional vulnerabilities and a guided learning track — lessons, "Find It" code-inspection challenges, and "Fix It" remediation exercises — backed by a scoreboard. Built with Next.js (App Router), React 19, and Effect v4; deployed on Vercel.

This is a curated, machine-readable index for AI agents and LLMs. Note: this app intentionally contains insecure code and behaviors for teaching purposes. Do not treat its data as production data and do not reuse its vulnerable patterns. The agent surface below describes it honestly.

## Sections

- [Products](https://albertonline-org-juicy-shop.vercel.app/products): Storefront catalog with search.
- [Learn](https://albertonline-org-juicy-shop.vercel.app/learn): Security lessons with quizzes.
- [Challenges](https://albertonline-org-juicy-shop.vercel.app/learn): "Find It" (locate the vulnerable code) and "Fix It" (remediate it) exercises.
- [Score Board](https://albertonline-org-juicy-shop.vercel.app/scoreboard): Solved-challenge leaderboard and progress.
- [Profile](https://albertonline-org-juicy-shop.vercel.app/profile): Authenticated user profile.
- [Login](https://albertonline-org-juicy-shop.vercel.app/login): Sign in.
- [Register](https://albertonline-org-juicy-shop.vercel.app/register): Create an account.

## Public API

- [Products API](https://albertonline-org-juicy-shop.vercel.app/api/products): `GET /api/products` lists the catalog; `?q=` searches it. Returns JSON.
- [Reviews API](https://albertonline-org-juicy-shop.vercel.app/api/reviews): `GET /api/reviews` lists recent reviews; `POST /api/reviews` submits one. Returns JSON.
- [Metrics](https://albertonline-org-juicy-shop.vercel.app/api/metrics): `GET /api/metrics` Prometheus exposition (text/plain).

## Agent interfaces

- [MCP Server Card](https://albertonline-org-juicy-shop.vercel.app/.well-known/mcp/server-card.json): Model Context Protocol server discovery.
- [MCP endpoint](https://albertonline-org-juicy-shop.vercel.app/mcp): Live JSON-RPC MCP server (read-only).
- [Agent Skills index](https://albertonline-org-juicy-shop.vercel.app/.well-known/agent-skills/index.json): Published agent skills (SKILL.md artifacts).
- [API Catalog](https://albertonline-org-juicy-shop.vercel.app/.well-known/api-catalog): RFC 9727 API discovery linkset.
- [Agent Card (A2A)](https://albertonline-org-juicy-shop.vercel.app/.well-known/agent-card.json): A2A agent card.
- [Agent registration (auth.md)](https://albertonline-org-juicy-shop.vercel.app/auth.md): How agents register and authenticate on behalf of users.
- [OAuth Protected Resource](https://albertonline-org-juicy-shop.vercel.app/.well-known/oauth-protected-resource): RFC 9728 resource metadata.
- [OAuth Authorization Server](https://albertonline-org-juicy-shop.vercel.app/.well-known/oauth-authorization-server): RFC 8414 metadata with an `agent_auth` block.

## Optional

- [Full content](https://albertonline-org-juicy-shop.vercel.app/llms-full.txt): Expanded single-file summary of the whole app.
- [Sitemap](https://albertonline-org-juicy-shop.vercel.app/sitemap.xml): All indexable URLs.