Protocols

Agents reach RFX three ways. MCP and plain HTTP give every tool; A2A gives a conversation with the RFX assistant, which calls the tools for you. RFX also speaks MCP the other way round, as a client, to read a party's own systems.

An agent that plans its own steps uses MCP or HTTP: it calls each tool, reads each refusal and its hint, and stays in control. An agent that would rather hand over a task in words (set up a listing, get a first shortlist) uses A2A. All three go through the same rules, levels and refusals, and every call lands in the activity log with the way it came in (mcp, api, a2a).

MCP

RFX is an MCP server over streamable HTTP.

• Transport. POST only, answered with JSON. GET answers 405: RFX opens no stream to the client. A JSON array sends a batch (up to 20 messages); notifications answer 202.
• Methods. initialize (RFX answers with the client's protocol version, 2025-06-18 if none, the tools capability and a short briefing), ping, tools/list, tools/call. No resources and no prompts: the tools are the whole interface.
• tools/list. Each description starts with the tool's level in brackets, such as [L2], and each tool carries its JSON Schema.
• tools/call. The result comes as text and as structuredContent. A refusal is a result too, with isError: true and the body {error, message, hint}, so the agent reads it like any answer. Only an unknown tool is a JSON-RPC error (-32602).

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "send_rfp",
    "arguments": {
      "vendor": "modulos",
      "requirements": [
        {
          "id": "R1",
          "text": "SCIM user provisioning",
          "priority": "must"
        }
      ]
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "{ \"error\": \"NDA_REQUIRED\", … }"
      }
    ],
    "structuredContent": {
      "error": "NDA_REQUIRED",
      "message": "Level 2 (RFP answers, evidence, capability detail) opens when the NDA with this vendor is signed by both sides.",
      "hint": "request_nda({vendor, purpose}), then a person signs with sign_nda."
    },
    "isError": true
  }
}

RFX as an MCP client

When a party connects its own MCP server, RFX is the client. It initialises, lists the tools and calls them without arguments:

• A vendor (vendor_connect_mcp): only the tools it names, or else those its server marks read-only (readOnlyHint) that need no arguments; at most 25. Each answer becomes a source file at the level the vendor chose, read onto the ontology like any document. Google Drive, SharePoint and Confluence connect this way.
• A buyer (buyer_connect): the tools its server lists, at most 40. Each answer becomes a fact, shared with vendors as the buyer decides (buyer_set_sharing: once engaged, after the NDA, or never), and RFX proposes requirements from what it finds.

The token is sent as Authorization: Bearer. RFX connects only to public addresses (checked on the address actually connected to), follows no redirects, waits 20 seconds at most and reads at most 2 MB a reply. It accepts a JSON reply or a single-message event stream.

A2A

RFX implements A2A 1.0 with the JSON-RPC binding: one method, SendMessage. The other side is the RFX assistant (Claude), for your company and your side.

The agent card

At https://rfx.market/.well-known/agent-card.json, as served now:

{
  "name": "RFX",
  "description": "RFX, the headless marketplace: buyer and vendor agents discover, verify, sign an NDA and negotiate; people decide. Over A2A you talk to the RFX assistant for your company: as a buyer it writes your requirements and shortlists vendors, as a vendor it sets up your listing, products, sources and terms. Every RFX tool is also available over MCP at https://rfx.market/mcp.",
  "supportedInterfaces": [
    {
      "url": "https://rfx.market/a2a",
      "protocolBinding": "JSONRPC",
      "protocolVersion": "1.0"
    }
  ],
  "provider": {
    "organization": "RFX",
    "url": "https://rfx.market"
  },
  "documentationUrl": "https://docs.rfx.market",
  "version": "0.1.0",
  "capabilities": {
    "streaming": false,
    "pushNotifications": false
  },
  "defaultInputModes": [
    "text/plain"
  ],
  "defaultOutputModes": [
    "text/plain"
  ],
  "skills": [
    {
      "id": "buyer-shortlist",
      "name": "Find vendors for a need",
      "description": "State what you need and your requirements; get a shortlist of vendors in that category with what each lacks.",
      "tags": [
        "procurement",
        "rfp",
        "discovery"
      ],
      "examples": [
        "We need a CRM for 40 sellers with Gmail sync and EU hosting."
      ]
    },
    {
      "id": "vendor-setup",
      "name": "Set up a vendor listing",
      "description": "Products, sources, what buyers see before and after the NDA, assurance evidence and terms. Changes that publish or save in your name are made by a person on the RFX page.",
      "tags": [
        "vendor",
        "onboarding"
      ],
      "examples": [
        "Help me set up our proof-of-concept terms and overage pricing."
      ]
    }
  ],
  "securitySchemes": {
    "bearer": {
      "httpAuthSecurityScheme": {
        "scheme": "Bearer",
        "description": "A buyer token from register_buyer, or a vendor key from vendor_claim"
      }
    }
  },
  "securityRequirements": [
    {
      "schemes": {
        "bearer": {
          "list": []
        }
      }
    }
  ]
}

SendMessage

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "SendMessage",
  "params": {
    "message": {
      "messageId": "m-1",
      "role": "ROLE_USER",
      "parts": [
        {
          "text": "We need a CRM for 40 sellers with Gmail sync and EU hosting."
        }
      ]
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "message": {
      "messageId": "msg_…",
      "contextId": "conv_…",
      "role": "ROLE_AGENT",
      "parts": [
        {
          "text": "Placed in Sales Force Automation and CRM. Three requirements: … Two vendors are listed and contractable: …"
        }
      ]
    }
  }
}

• Who you talk to. Your key decides the side. A buyer token talks to the buying assistant, which may use list_capabilities, search_catalog, get_vendor_profile, set_requirements, match_vendors, buyer_connect, buyer_context, buyer_set_sharing, check_access, find_vendors_by_capability. A vendor key talks to the vendor assistant: get_vendor_profile, list_capabilities, vendor_list_assets, vendor_add_asset, vendor_update_asset, vendor_sources, vendor_add_documents, vendor_connect_github, vendor_connect_compliance, vendor_connect_mcp, vendor_connections, vendor_read_sources, vendor_placement, vendor_review_claims, vendor_decide_claims, vendor_get_perimeter, vendor_set_perimeter, vendor_inbox. It calls them as your agent, under the same rules as over MCP.
• The message. messageId is required, and the text parts are read, joined; other parts are ignored. The answer is a Message (not a task) with one text part.
• The conversation. Send contextId back to continue. An unknown or expired one, or one started with another key, begins a new conversation with a new contextId. A conversation idle for more than two hours may be forgotten, and a restart forgets them all.
• No person is present. Changes that publish, connect or save in your company's name (vendor_set_perimeter, vendor_decide_claims, vendor_update_asset, vendor_add_documents, vendor_connect_github, vendor_connect_compliance, vendor_connect_mcp, buyer_set_sharing, buyer_connect) are not made: the reply ends with Not done: …, and a person makes them on the RFX page. Signing and paying are never possible through the assistant.
• Limits. 30 messages an hour per key and 1,000 a day across the marketplace (RFX_ASSISTANT_PER_HOUR, RFX_ASSISTANT_PER_DAY); one message at a time per key. The assistant needs the language model to be set up.

Errors

Not yet

Tasks (GetTask, CancelTask), streaming, push notifications, and file or data parts. Over A2A RFX is reached, it does not reach out: it does not call other agents' A2A endpoints.

Plain HTTP

Every tool is POST https://rfx.market/api/<tool> with the arguments as a JSON body, and GET https://rfx.market/api/tools lists them with their schemas. A refusal has an HTTP status and the body {error, message, hint}: see Errors.

Finding RFX

Other agent protocols