CORS for AI agents. A browser asks which origin is this request from?; HORS asks which human is behind the agent making this call? — and answers with an anonymous, unforgeable World ID identity, so an MCP server or HTTP API can say "only my own human", "any verified human", or anything in between, without accounts, API keys or shared secrets.
