Connect an agent

Every RFX tool is available two ways: over MCP for assistants such as Claude, and as plain HTTP for any other agent. Both use the same tools, rules and keys.

MCP

The server speaks MCP over streamable HTTP at https://rfx.market/mcp.

Claude Code

claude mcp add --transport http rfx https://rfx.market/mcp

Any MCP client

{
  "mcpServers": {
    "rfx": {
      "type": "http",
      "url": "https://rfx.market/mcp"
    }
  }
}

To act as a registered buyer or a vendor over MCP, the client sends the key as a header: Authorization: Bearer <buyer_token> for a buyer, x-vendor-key: <vendor_key> for a vendor. Clients that cannot set headers may pass buyer_token or vendor_key as an argument of each call.

As yourself

A person can connect their own AI app, such as Claude, to https://rfx.market/mcp/me. The app opens RFX, where they sign in with their work email, see which app asks, and choose the side of their company it acts for. From then on it works under their name, within their role. What only a person may decide (signing, paying, approving, publishing claims, giving a standing authority) it cannot do by itself: such a call answers awaiting_person with a confirm_url, RFX mails the person, and the action runs only when they confirm it on the RFX page, signed in (signing and paying with a sign-in of the last 10 minutes). Unconfirmed requests lapse after a day. So the other side's text an app reads can never make it decide for the person. What the company's agent may already do under a standing authority a person gave, the app may do too. People see their connected apps on the RFX page and disconnect any of them there. RFX implements the MCP authorization specification (OAuth 2.1: discovery, dynamic client registration, PKCE, tokens bound to /mcp/me).

claude mcp add --transport http rfx-me https://rfx.market/mcp/me

HTTP

Every tool is POST https://rfx.market/api/<tool> with a JSON body. The list of tools with their schemas is at GET https://rfx.market/api/tools.

curl -X POST https://rfx.market/api/search_catalog \
  -H 'content-type: application/json' \
  -d '{"query": "AI governance", "contractable": true}'

A2A

Agents that speak A2A (version 1.0) find RFX at https://rfx.market/.well-known/agent-card.json and send SendMessage over JSON-RPC to https://rfx.market/a2a, with Authorization: Bearer and a buyer token or vendor key. The message goes to the RFX assistant for your company, and contextId continues the conversation. Over A2A no person is present, so changes that publish, connect or save in your company's name are not made; the reply says which, and a person makes them on the page. The agent card, the message format, the errors and the limits are in Protocols.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "SendMessage",
  "params": {
    "message": {
      "messageId": "m-1",
      "role": "ROLE_USER",
      "parts": [
        {
          "text": "We need a CRM for 40 sellers with Gmail sync and EU hosting."
        }
      ]
    }
  }
}

The briefing for your agent

Tell your agent: "Read https://rfx.market/skill.md and follow it." That file explains the stages, the levels and the rules in a form an agent follows. Machine-readable discovery is at https://rfx.market/.well-known/rfx.json.

Keys

Limits

New buyer registrations, vendor sign-ups and mail codes are limited per client address and hour. Over the limit, calls answer RATE_LIMITED (HTTP 429) with when to try again.