Authless variant of the MCP endpoint for clients that cannot send custom headers (e.g. the claude.ai connector UI). The vendor token is carried in the URL path and lifted into the Authorization header server-side. The whole URL is a credential — use it for demos/testing only and build production agents against the bearer-header endpoint above. Every rejection returns 404 (so clients do not trigger OAuth discovery and link existence is not leaked). Request and response bodies are identical to POST /mcp/skin-analysis.