Developers and agents

AutoRFP.ai API and MCP documentation

AutoRFP.ai is the accuracy-first, AI-native, source-grounded platform for RFPs, security questionnaires, and DDQs. Agents connect through a read-only Model Context Protocol server that keeps source citations and applies each user’s existing workspace permissions.

OpenAPI 3.1 specification

Typed operations, OAuth scopes, JSON schemas, errors, and regional MCP servers.

MCP discovery manifest

Machine-readable server metadata for automatic client discovery.

Streamable HTTP endpoints

Choose the region where your AutoRFP.ai workspace is hosted. Each server exposes one /mcpendpoint and accepts JSON-RPC requests over HTTP POST.

OAuth and scoped permissions

The server uses OAuth 2.0 Authorization Code with PKCE. Request only the scopes needed for the tools your agent will call. The token does not expand a user’s access, and row-level workspace permissions continue to apply.

Scope	Permission
tags:read	Read the workspace tag vocabulary.
projects:read	Read projects and their requirements.
content:read	Search and read approved content and its usage.

Authorization metadata: OAuth server andMCP protected resource.

Request example

Send both response media types required by Streamable HTTP and include the protocol version with every request.

curl https://api.autorfp.ai/mcp \
  -X POST \
  -H "Authorization: Bearer $AUTORFP_ACCESS_TOKEN" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  -H "Accept: application/json, text/event-stream" \
  -H "Content-Type: application/json" \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

JSON errors

Protocol and authentication failures return structured JSON. The error field is stable for programmatic handling, while error_description explains how to resolve the request.

{
  "error": "invalid_token",
  "error_description": "Missing Authorization header"
}