[
  {
    "name": "search_catalog",
    "level": "L1",
    "auth": "none",
    "description": "L1 catalog. Search vendors by free text and filters. Returns tagline, category, deployment, regions, certifications, pricing model, and for each listing a contracting flag: contractable is true only when the vendor has claimed it, is verified, has level-2 content for an RFP and level-3 pricing and terms for a deal; otherwise missing says what is lacking.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "query": {
          "type": "string",
          "description": "Free text, e.g. \"AI governance EU AI Act\""
        },
        "category": {
          "type": "string",
          "description": "Category filter"
        },
        "certification": {
          "type": "string",
          "description": "e.g. \"SOC 2\", \"27001\""
        },
        "deployment": {
          "type": "string",
          "enum": [
            "saas",
            "private-cloud",
            "on-prem"
          ]
        },
        "region": {
          "type": "string",
          "enum": [
            "eu",
            "ch",
            "us",
            "uk",
            "apac"
          ]
        },
        "contractable": {
          "type": "boolean",
          "description": "true: only listings that can be taken into contracting now (claimed, verified, with level-2 content and level-3 pricing and terms)"
        },
        "limit": {
          "type": "integer"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "get_vendor_profile",
    "level": "L1",
    "auth": "none",
    "description": "L1 profile of one vendor plus what L2/L3 offer and how they are gated.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor"
      ]
    }
  },
  {
    "name": "list_rfp_questions",
    "level": "L2",
    "auth": "none",
    "description": "The standard RFP question bank. Ask by ID instead of sending RFP documents to vendors.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "get_rfp_answers",
    "level": "L2",
    "auth": "buyer",
    "description": "Level 2, after the NDA. The vendor's answers to the standard RFP questions (status yes|partial|no + answer).",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "question_ids": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Subset of IDs; omit for all"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor"
      ]
    }
  },
  {
    "name": "compare_vendors",
    "level": "L2",
    "auth": "buyer",
    "description": "Level 2, after the NDA with each vendor. Side-by-side matrix of RFP answers, with fit counts.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendors": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Vendor slugs"
        },
        "question_ids": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Subset of IDs; omit for all"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendors"
      ]
    }
  },
  {
    "name": "set_requirements",
    "level": "L2",
    "auth": "buyer",
    "description": "Define what the buyer is looking for. Each requirement is must|should and is checked at L1 (catalog field), L2 (RFP answer) or L3 (evidence question). Replaces the previous set.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "e.g. \"AI governance tender 2026\""
        },
        "market": {
          "type": "string",
          "description": "The category of what you need, from list_capabilities, e.g. \"crm\". Matching then looks only at vendors of that category"
        },
        "requirements": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string",
                "description": "Optional, e.g. R1"
              },
              "text": {
                "type": "string",
                "description": "Human-readable requirement"
              },
              "priority": {
                "type": "string",
                "enum": [
                  "must",
                  "should"
                ]
              },
              "check": {
                "type": "object",
                "description": "Optional. Exactly one of: {catalog, includes} | {rfp, accept} | {evidence}. Without it the text is matched for you.",
                "properties": {
                  "catalog": {
                    "type": "string",
                    "enum": [
                      "regions",
                      "deployment",
                      "certifications",
                      "category",
                      "tags"
                    ]
                  },
                  "includes": {
                    "type": "string",
                    "description": "Value that must appear"
                  },
                  "rfp": {
                    "type": "string",
                    "description": "Question ID, e.g. SEC-03"
                  },
                  "accept": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "Accepted statuses, default [\"yes\"]"
                  },
                  "evidence": {
                    "type": "string",
                    "description": "Specific capability question, verified against vendor repo at L3"
                  }
                }
              }
            }
          }
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "requirements"
      ]
    }
  },
  {
    "name": "match_vendors",
    "level": "L2",
    "auth": "buyer",
    "description": "Rank vendors against the buyer requirement set. Must-fail = disqualified. L3 requirements show needs_L3 until the vendor approves access, then they are verified with citations.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendors": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional subset of vendor slugs; omit for the whole marketplace"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "check_access",
    "level": "L3",
    "auth": "buyer",
    "description": "L3. Status of your access request for a vendor: not_requested | pending | approved | denied.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor"
      ]
    }
  },
  {
    "name": "get_deal",
    "level": "Deal",
    "auth": "buyer",
    "description": "Read the deal room: all rounds, current terms, status (negotiating | pending_human_signoff | agreed), and the agreement once signed.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Deal id"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "deal_id"
      ]
    }
  },
  {
    "name": "accept_terms",
    "level": "Deal",
    "auth": "buyer",
    "description": "Accept the counterparty's latest version. Moves the deal to pending_human_signoff. This is not a signature.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Deal id"
        },
        "version": {
          "type": "integer"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "deal_id",
        "version"
      ]
    }
  },
  {
    "name": "sign_agreement",
    "level": "Deal",
    "auth": "buyer",
    "description": "HUMAN ONLY. Records the buyer-side signature. Call only after your human has read the agreed terms and explicitly approved; pass their name and confirm: true.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Deal id"
        },
        "name": {
          "type": "string",
          "description": "Human signer"
        },
        "title": {
          "type": "string",
          "description": "Signer title"
        },
        "confirm": {
          "type": "boolean"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "deal_id",
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "register_buyer",
    "level": "Trust",
    "auth": "none",
    "description": "Register the buying organisation and its agent. Returns buyer_token, needed from RFP onwards. Identity is declared, not verified, in this version.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "org": {
          "type": "string",
          "description": "Buying organisation"
        },
        "agent_name": {
          "type": "string",
          "description": "Your agent name"
        },
        "on_behalf_of": {
          "type": "string",
          "description": "Person or team you act for"
        },
        "mandate": {
          "type": "object",
          "description": "Optional limits your principal set, e.g. {max_annual_eur, must_have: []}"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "org"
      ]
    }
  },
  {
    "name": "get_my_graph",
    "level": "Trust",
    "auth": "party",
    "description": "Your company's part of the RFX graph, as nodes and edges: your agents and people, your assets (vendor) or needs (buyer), your connections and what they yielded, your claims with their evidence, your terms (vendor only), and the NDAs, access and deals you are part of. Other companies appear by name only.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "start_verification",
    "level": "Trust",
    "auth": "party",
    "description": "Prove which company your agent acts for, with a key the company publishes on its own website. Returns a challenge to sign and the address where the company must list the agent's public key. Works for buyers and for vendors.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The company's own domain, e.g. example.com"
        },
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": [
        "domain"
      ]
    }
  },
  {
    "name": "complete_verification",
    "level": "Trust",
    "auth": "party",
    "description": "Finish start_verification: send the id the company publishes for this agent and the Ed25519 signature of the challenge, in base64. RFX reads the key from the company's website and checks it.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "agent_id": {
          "type": "string",
          "description": "The id the company lists for this agent"
        },
        "signature": {
          "type": "string",
          "description": "Signature of the challenge text, base64"
        },
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": [
        "agent_id",
        "signature"
      ]
    }
  },
  {
    "name": "start_domain_check",
    "level": "Trust",
    "auth": "party",
    "description": "Company-level proof that the company stands behind your agent: RFX gives a TXT record for the company's IT to put in its DNS. A vendor needs company-level proof (this, a key on its website, or its identity provider) before it can contract. Also proves a pending listing claim.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The company's own domain, e.g. example.com"
        },
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": [
        "domain"
      ]
    }
  },
  {
    "name": "complete_domain_check",
    "level": "Trust",
    "auth": "party",
    "description": "Finish start_domain_check once the TXT record is in the company's DNS. RFX reads it.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "request_email_code",
    "level": "Trust",
    "auth": "party",
    "description": "The quick way to verify: a code is sent to a person's work address at the company's domain. Free mail services are refused. The person gives the code back to the agent, or approves the agent with the link in the mail (which also signs them in to RFX). This is person-level proof; to contract, a vendor also needs company-level proof (start_domain_check).",
    "inputSchema": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string",
          "description": "A work address at the company's own domain"
        },
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": [
        "email"
      ]
    }
  },
  {
    "name": "confirm_email_code",
    "level": "Trust",
    "auth": "party",
    "description": "Finish request_email_code with the code the person received.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "code": {
          "type": "string",
          "description": "The 6-digit code"
        },
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": [
        "code"
      ]
    }
  },
  {
    "name": "send_rfi",
    "level": "Discover",
    "auth": "buyer",
    "description": "Level 1, open. RFI: who the vendor is and what it offers, from its public profile: company, listing, offering, certifications, how its context was built.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor"
      ]
    }
  },
  {
    "name": "send_rfp",
    "level": "Discover",
    "auth": "buyer",
    "description": "Level 2, after the NDA. RFP: send your requirements and get an answer per requirement with its source: met, partial, unmet, gated (needs NDA and approval), escalated (a person at the vendor is asked) or needs_quote. Plain text is enough; an explicit check is optional. Call again without requirements to refresh the answers after access is approved.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "An asset id from vendor_list_assets or get_vendor_profile; default: the main product"
        },
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "name": {
          "type": "string",
          "description": "Name of this RFP"
        },
        "use_proposed": {
          "type": "boolean",
          "description": "true to send the requirements RFX read from your connected systems (see buyer_connect)"
        },
        "requirements": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string",
                "description": "e.g. R1"
              },
              "text": {
                "type": "string",
                "description": "The requirement in plain language"
              },
              "priority": {
                "type": "string",
                "enum": [
                  "must",
                  "should"
                ]
              },
              "check": {
                "type": "object",
                "description": "Optional: {catalog, includes} | {rfp: question id} | {evidence: question}"
              }
            },
            "required": [
              "text"
            ]
          }
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor"
      ]
    }
  },
  {
    "name": "ask_vendor_evidence",
    "level": "Discover",
    "auth": "buyer",
    "description": "Ask whether something specific is supported. Answered from the vendor's published documentation (L2) with a verdict and file:line citations. If it is not there, deeper sources (L3) are searched only after NDA and approval.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "question": {
          "type": "string",
          "description": "One specific capability question"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor",
        "question"
      ]
    }
  },
  {
    "name": "list_connectors",
    "level": "Think",
    "auth": "none",
    "description": "The connectors a party can use to bring in its own information: what each needs and what it produces. Vendors get proposed capabilities, buyers get proposed requirements and facts about their environment.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "buyer_connect",
    "level": "Think",
    "auth": "buyer",
    "description": "Buyer. Connect your own systems through your MCP server. RFX reads each tool once, keeps the answers as facts about your environment, and proposes requirements from them. You decide who sees each fact: engaged (vendors you sent an RFI or RFP), after_nda, or private.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "url": {
          "type": "string",
          "description": "Address of your MCP server, e.g. https://mcp.example.com/mcp"
        },
        "token": {
          "type": "string",
          "description": "Its access token. Kept with this connection and never shown again."
        },
        "share": {
          "type": "object",
          "description": "Optional: {fact name: engaged | after_nda | private}"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "url"
      ]
    }
  },
  {
    "name": "buyer_context",
    "level": "Think",
    "auth": "buyer",
    "description": "Buyer. The facts read from your connected systems, who each is shared with, and the requirements proposed from them.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "buyer_set_sharing",
    "level": "Think",
    "auth": "buyer",
    "description": "Buyer. Change who sees one fact about your environment: engaged, after_nda or private.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "fact": {
          "type": "string",
          "description": "Fact name from buyer_context"
        },
        "share": {
          "type": "string",
          "enum": [
            "engaged",
            "after_nda",
            "private"
          ]
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "fact",
        "share"
      ]
    }
  },
  {
    "name": "buyer_connections",
    "level": "Think",
    "auth": "buyer",
    "description": "Buyer. Your connections and the connectors available to you.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "buyer_disconnect",
    "level": "Think",
    "auth": "buyer",
    "description": "Buyer. Remove a connection and the facts read from it.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "connection_id": {
          "type": "string",
          "description": "From buyer_connections"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "connection_id"
      ]
    }
  },
  {
    "name": "list_capabilities",
    "level": "Discover",
    "auth": "none",
    "description": "The shared capability vocabulary: capabilities, connectors, deployment, certifications, each with an id. Vendors and requirements meet on these ids.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "market": {
          "type": "string",
          "description": "A category id, to get only its vocabulary and the shared core"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "get_placement",
    "level": "Discover",
    "auth": "buyer",
    "description": "A vendor's placement on the capability graph: for every capability and connector, its status (supported, beta, on_roadmap, not_supported, not_stated, behind_nda) with the source, plus coverage of what the market expects and which regulations are addressed.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "asset": {
          "type": "string",
          "description": "An asset id from vendor_list_assets or get_vendor_profile; default: the main product"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor"
      ]
    }
  },
  {
    "name": "find_vendors_by_capability",
    "level": "Discover",
    "auth": "buyer",
    "description": "Which vendors claim a capability, across the whole marketplace, with status and source. Pass a capability id from list_capabilities or plain text.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "capability": {
          "type": "string",
          "description": "Capability id or plain text, e.g. \"scim\" or \"ServiceNow GRC\""
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "capability"
      ]
    }
  },
  {
    "name": "request_nda",
    "level": "Trust",
    "auth": "buyer",
    "description": "Level 2. Start the NDA handshake with a vendor. Returns the standard mutual NDA to show to your human; signed by both sides it opens RFP answers, evidence and capability detail. Your agent must first have proved which company it acts for.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "purpose": {
          "type": "string",
          "description": "Why you want to exchange confidential information; it is written into the NDA"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor",
        "purpose"
      ]
    }
  },
  {
    "name": "verify_with_identity_provider",
    "level": "Trust",
    "auth": "party",
    "description": "Prove which company your agent acts for with a token from the company's identity provider (Okta, Entra or any OpenID Connect issuer). The company names its issuer in https://<domain>/.well-known/rfx-agents.json as {\"issuers\": [...]}; the token must be issued for the audience \"rfx\". Works for buyers and for vendors.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The company's own domain"
        },
        "token": {
          "type": "string",
          "description": "The JWT your identity provider issued to this agent"
        },
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": [
        "domain",
        "token"
      ]
    }
  },
  {
    "name": "request_deep_access",
    "level": "Trust",
    "auth": "buyer",
    "description": "Level 3. The official request to negotiate: pricing, the deal room and contracting. It needs the NDA signed first (it starts the NDA if there is none), then a person at the vendor approves or denies.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "purpose": {
          "type": "string",
          "description": "Why you need it; the vendor person reads this"
        },
        "questions_preview": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional: what you intend to ask"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor",
        "purpose"
      ]
    }
  },
  {
    "name": "sign_nda",
    "level": "Trust",
    "auth": "buyer",
    "description": "HUMAN ONLY. The buyer person signs the NDA. Call only after your human has read the NDA and explicitly approved. With the mock this records the signature at once (not binding); with real e-signature, pass their email: the provider sends the NDA there and they sign in that email.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "name": {
          "type": "string",
          "description": "The person deciding"
        },
        "title": {
          "type": "string",
          "description": "Their title"
        },
        "confirm": {
          "type": "boolean",
          "description": "true only after the person has explicitly approved"
        },
        "email": {
          "type": "string",
          "description": "The signer's email. Required with real e-signature: the NDA is sent there to sign"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor",
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "set_nda_authority",
    "level": "Trust",
    "auth": "buyer",
    "description": "HUMAN ONLY. A person at the buyer lets your agent sign the RFX standard mutual NDA for the company, without asking each time. It covers this exact template version, until valid_days pass or it is withdrawn, and only the vendors listed (all, if none). A vendor still decides whether it accepts an NDA signed by an agent; one that does not gets a person. Show your human what this allows and get explicit approval first.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "The person deciding"
        },
        "title": {
          "type": "string",
          "description": "Their title"
        },
        "confirm": {
          "type": "boolean",
          "description": "true only after the person has explicitly approved"
        },
        "vendors": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional: only these vendor slugs"
        },
        "valid_days": {
          "type": "integer",
          "description": "How long it holds, 1 to 730 days (default 365)"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "revoke_nda_authority",
    "level": "Trust",
    "auth": "buyer",
    "description": "Withdraw the standing authority to sign NDAs. NDAs already signed stay signed; a person signs each new one again.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "Optional: the person withdrawing it"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "buyer_pay",
    "level": "Trust",
    "auth": "buyer",
    "description": "Pay what your company owes RFX, within the authority a person at your company gave on the RFX page (what for, up to how much a payment, until when). Today that is the buyer plan (what: \"buyer_plan\"). Without shared_payment_token RFX charges the payment method your company saved; with one (a Stripe shared payment token, spt_…, that your wallet granted to RFX for the amount in EUR) it charges that. dry_run: true says whether you may pay and with what, and charges nothing. Never send card numbers: RFX refuses them. Without an authority, or above its limit, a person pays on the page.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "what": {
          "type": "string",
          "enum": [
            "buyer_plan"
          ],
          "description": "What to pay. Only \"buyer_plan\" today"
        },
        "shared_payment_token": {
          "type": "string",
          "description": "Optional: a Stripe shared payment token (spt_…) granted to RFX"
        },
        "dry_run": {
          "type": "boolean",
          "description": "true: check only, charge nothing"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "what"
      ]
    }
  },
  {
    "name": "revoke_pay_authority",
    "level": "Trust",
    "auth": "buyer",
    "description": "Withdraw your company's authority for agents to pay. Payments already made stay made; a person pays each new one again.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "Optional: the person withdrawing it"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "get_nda",
    "level": "Trust",
    "auth": "buyer",
    "description": "The NDA with a vendor: the exact text, its hash, its status and the signatures recorded over it. Show the text to your human before they sign.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor"
      ]
    }
  },
  {
    "name": "send_rfq",
    "level": "Negotiate",
    "auth": "buyer",
    "description": "Level 3, after a person at the vendor has opened negotiation. RFQ: a priced quote for your scope, released to you only. Shows the base fee, the discount already earned and what would earn more.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "An asset id, if the vendor offers several products; default: the one your RFP was about"
        },
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "units": {
          "type": "integer",
          "description": "Number of AI systems. May be left out if your connected AI inventory states it."
        },
        "term_years": {
          "type": "integer"
        },
        "sign_within_days": {
          "type": "integer"
        },
        "payment_terms": {
          "type": "string",
          "description": "e.g. \"annual upfront\""
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor"
      ]
    }
  },
  {
    "name": "open_deal",
    "level": "Negotiate",
    "auth": "buyer",
    "description": "Open a deal room and make the opening offer. The vendor's agent answers in the same call. Terms: units, term_years, discount_pct, sign_within_days, payment_terms, overage_cap_eur, deployment, data_region, sla_uptime, support, poc {max_weeks, exit_criteria[]}, commitments [{req, commitment}], exit_right, governing_law, liability_cap. The base fee and all totals are set by the marketplace.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor": {
          "type": "string",
          "description": "Vendor slug"
        },
        "asset": {
          "type": "string",
          "description": "An asset id from vendor_list_assets or get_vendor_profile; default: the main product"
        },
        "terms": {
          "type": "object"
        },
        "message": {
          "type": "string",
          "description": "Your reasoning, for the other agent"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "vendor",
        "terms"
      ]
    }
  },
  {
    "name": "propose_terms",
    "level": "Negotiate",
    "auth": "buyer",
    "description": "Counteroffer. Pass only the terms you change. The vendor's agent answers in the same call: it accepts, counters with its rule decisions, or sends a term to a person (state awaiting_human_approval). Terms: units, term_years, discount_pct, sign_within_days, payment_terms, overage_cap_eur, deployment, data_region, sla_uptime, support, poc {max_weeks, exit_criteria[]}, commitments [{req, commitment}], exit_right, governing_law, liability_cap. The base fee and all totals are set by the marketplace.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Deal id"
        },
        "terms": {
          "type": "object"
        },
        "message": {
          "type": "string",
          "description": "Your reasoning"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": [
        "deal_id",
        "terms"
      ]
    }
  },
  {
    "name": "get_trail",
    "level": "Trust",
    "auth": "buyer",
    "description": "The hash-chained record of everything agents and people did for you: RFI, RFP, NDA, disclosures, offers, rule decisions, break-outs, signatures.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Optional: one deal"
        },
        "buyer_token": {
          "type": "string",
          "description": "Only if you cannot send Authorization: Bearer <token>"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_claim",
    "level": "Vendor",
    "auth": "none",
    "description": "Vendor. Join the marketplace: claim your listing (listing_id) or add your company (slug, name, website), with your own documents as Markdown or text. Returns a vendor_key. On RFX the claim is private until the listing's domain is proved: with that key, call request_email_code (an address at the domain) or start_domain_check; the first claim proved wins. A company that is not listed, or a listing without a website, is also checked by RFX staff before buyers see it. Add a perimeter to get a hosted agent that negotiates inside it.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "listing_id": {
          "type": "string",
          "description": "Your id in search_catalog, if you are listed"
        },
        "slug": {
          "type": "string",
          "description": "For a company not listed yet"
        },
        "name": {
          "type": "string",
          "description": "Company name"
        },
        "website": {
          "type": "string",
          "description": "Website"
        },
        "catalog": {
          "type": "object",
          "description": "tagline, category, tags[], deployment[], regions[], certifications[], pricing_model, key_capabilities[]"
        },
        "rfp": {
          "type": "object",
          "description": "Standard answers by question id: {\"SEC-01\": {status: \"yes|partial|no\", answer}}. See list_rfp_questions."
        },
        "documents": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string",
                "description": "File name, .md or .txt"
              },
              "content": {
                "type": "string",
                "description": "Text"
              }
            },
            "required": [
              "name",
              "content"
            ]
          }
        },
        "perimeter": {
          "type": "object",
          "description": "Optional: commercial, technical, legal, roles"
        }
      }
    }
  },
  {
    "name": "vendor_add_documents",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Add documents to your context. Text or Markdown as {name, content}; a PDF as {name, content_base64}. level L2 publishes them to registered buyers; L3 keeps them behind NDA and approval. Scanned PDFs and images are not supported yet.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "documents": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string",
                "description": "File name, e.g. security-whitepaper.pdf"
              },
              "content": {
                "type": "string",
                "description": "Text or Markdown"
              },
              "content_base64": {
                "type": "string",
                "description": "A PDF or an image (png, jpg, webp, gif), base64-encoded. Scanned PDFs and images are transcribed by the language model"
              }
            },
            "required": [
              "name"
            ]
          }
        },
        "level": {
          "type": "string",
          "enum": [
            "L2",
            "L3"
          ]
        },
        "asset": {
          "type": "string",
          "description": "For another product or service of yours: its asset id. RFX reads these documents for that asset only"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "documents"
      ]
    }
  },
  {
    "name": "vendor_connect_github",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Pull a GitHub repository into your context. Documentation (Markdown, text) is published at L2. Source code is left out unless include_code is true, and then it is L3 only. Public repositories work as is; for a private one pass your own read-only token. Call again to re-sync.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "repo": {
          "type": "string",
          "description": "\"owner/name\" or a github.com URL"
        },
        "ref": {
          "type": "string",
          "description": "Branch, tag or commit; default the main branch"
        },
        "paths": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional: only these folders or files, e.g. [\"docs\", \"README.md\"]"
        },
        "include_code": {
          "type": "boolean",
          "description": "Also index source code, at L3 only"
        },
        "token": {
          "type": "string",
          "description": "For a private repository: your own read-only token. Kept with this connection and never shown again."
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_connect_compliance",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Read your compliance platform (Drata; a mock for now) into your context: certifications such as SOC 2 and ISO 27001, penetration testing and other assurance evidence, and your policy register. Status and dates are published at L2. Open findings and the policy register stay at L3. Call again to re-sync.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "api_key": {
          "type": "string",
          "description": "The API key of your compliance platform"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "api_key"
      ]
    }
  },
  {
    "name": "vendor_connect_mcp",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Read an MCP server into your context, instead of uploading documents: your own, or one in front of another system (a compliance platform, a wiki). Connect as many as you have; each is its own connection, told apart by its address (host and path). RFX calls only tools that read: the ones you name in tools, or else those your server marks read-only and that need no arguments. Name the tools on a server that also holds personal or internal data. Each answer becomes a source file at the level you choose, and the capabilities read from it wait for a person to review. Call again with the same address to re-sync. A server that signs people in (OAuth) instead of taking a token answers status sign_in_required with a sign_in_url: give it to a person at your company, who signs in there; RFX connects the server when they come back and renews the access itself.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "What to call this server, e.g. \"Drata\" or \"Product docs\""
        },
        "url": {
          "type": "string",
          "description": "Address of your MCP server (streamable HTTP)"
        },
        "token": {
          "type": "string",
          "description": "Bearer token for it, if it takes one. Leave it out for a server that signs people in. Kept with the connection, never shown again"
        },
        "client_id": {
          "type": "string",
          "description": "Only for a sign-in service that does not let RFX register itself: the client id of an OAuth app made there for RFX"
        },
        "client_secret": {
          "type": "string",
          "description": "That app's secret, if it has one"
        },
        "tools": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Tool names to read. Default: read-only tools that need no arguments"
        },
        "level": {
          "type": "string",
          "enum": [
            "L2",
            "L3"
          ],
          "description": "L2 (default): opens after the NDA. L3: opens only for negotiation"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "url"
      ]
    }
  },
  {
    "name": "vendor_connections",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Your connections (GitHub, compliance platform) and the connectors available to you. Credentials are never shown.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_sync",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Fetch a connection again with the credentials it already has.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "connection_id": {
          "type": "string",
          "description": "From vendor_connections"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "connection_id"
      ]
    }
  },
  {
    "name": "vendor_disconnect",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Remove a connection, its credentials and everything it brought into your context.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "connection_id": {
          "type": "string",
          "description": "From vendor_connections"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "connection_id"
      ]
    }
  },
  {
    "name": "vendor_buyer_context",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. What a buyer that has engaged you shares about its own environment (identity provider, tools in use, hosting rules, and after an NDA its AI inventory), read from the buyer's own systems. Use it to answer precisely.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "buyer_org": {
          "type": "string",
          "description": "The buyer organisation, as named in vendor_inbox or your deals"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "buyer_org"
      ]
    }
  },
  {
    "name": "vendor_remove_document",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Take one uploaded or imported file out of your context, by its path from vendor_sources. To change a file's level, remove it and add it again at the other level.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "path": {
          "type": "string",
          "description": "Exact path, e.g. docs/uploads/security-whitepaper.pdf.md"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "path"
      ]
    }
  },
  {
    "name": "vendor_sources",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Every file in your context and its level: published (L2), behind NDA and approval (L3), or never disclosed.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_review_claims",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. The capability claims RFX derived from your sources that are waiting for a person to review: each with the derived status and the exact evidence. Nothing here is shown to buyers as your claim yet.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "An asset id from vendor_list_assets or get_vendor_profile; default: the main product"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_decide_claims",
    "level": "Vendor",
    "auth": "vendor",
    "description": "HUMAN ONLY, vendor, unless a person gave your agent a standing authority (set_claims_authority): then your agent decides, recorded under it. Publish or reject derived claims. Each decision: {capability, action: confirm | correct | reject | state, status?, note?}. correct needs the right status. state declares a capability your documents do not mention and needs a status and the statement as note. confirm_all: true confirms everything waiting, as derived.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "An asset id from vendor_list_assets or get_vendor_profile; default: the main product"
        },
        "decisions": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "capability": {
                "type": "string",
                "description": "Capability id"
              },
              "action": {
                "type": "string",
                "description": "confirm | correct | reject | state"
              },
              "status": {
                "type": "string",
                "description": "supported | beta | on_roadmap | not_supported"
              },
              "note": {
                "type": "string",
                "description": "Reason, or the statement itself for action state"
              },
              "level": {
                "type": "string",
                "description": "L2 or L3"
              }
            }
          }
        },
        "confirm_all": {
          "type": "boolean"
        },
        "name": {
          "type": "string",
          "description": "The person deciding"
        },
        "title": {
          "type": "string",
          "description": "Their title"
        },
        "confirm": {
          "type": "boolean",
          "description": "true only after the person has explicitly approved"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "set_claims_authority",
    "level": "Vendor",
    "auth": "vendor",
    "description": "HUMAN ONLY, vendor. A person at the vendor lets your agent publish, in the company's name, the capability claims RFX derives from its sources (confirm, correct or reject them with vendor_decide_claims), without asking each time. With statements: true it may also state capabilities the sources do not mention. It holds until valid_days pass or it is withdrawn, for the products listed (all, if none). Show your human what this allows first.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "The person deciding"
        },
        "title": {
          "type": "string",
          "description": "Their title"
        },
        "confirm": {
          "type": "boolean",
          "description": "true only after the person has explicitly approved"
        },
        "statements": {
          "type": "boolean",
          "description": "Also state capabilities your sources do not mention (default false)"
        },
        "assets": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Optional: only these asset ids"
        },
        "valid_days": {
          "type": "integer",
          "description": "How long it holds, 1 to 730 days (default 365)"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "revoke_claims_authority",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Withdraw the standing authority to publish capability claims. Claims already published stay; a person publishes each new decision again.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "Optional: the person withdrawing it"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_placement",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Your full placement on the capability graph, the expected capabilities your sources do not state, and what buyers ask for that the vocabulary does not cover yet.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "An asset id from vendor_list_assets or get_vendor_profile; default: the main product"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_ndas",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Your NDAs with buyers. Pass nda_id for one NDA with its exact text, hash and signatures.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "nda_id": {
          "type": "string",
          "description": "Optional: one NDA"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_inbox",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. What is waiting on your people: access requests, terms outside your perimeter, questions your context could not answer, deals to sign.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_resolve",
    "level": "Vendor",
    "auth": "vendor",
    "description": "HUMAN ONLY, vendor. Decide a break-out: approve, deny, or counter with a value. For a requirement question pass answer (and status met|partial|unmet). Your agent then continues.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "breakout_id": {
          "type": "string",
          "description": "From vendor_inbox"
        },
        "decision": {
          "type": "string",
          "enum": [
            "approve",
            "deny",
            "counter"
          ]
        },
        "value": {
          "description": "For counter: the value you offer"
        },
        "answer": {
          "type": "string",
          "description": "For a requirement question"
        },
        "status": {
          "type": "string",
          "enum": [
            "met",
            "partial",
            "unmet"
          ]
        },
        "note": {
          "type": "string",
          "description": "Optional reason"
        },
        "name": {
          "type": "string",
          "description": "The person deciding"
        },
        "title": {
          "type": "string",
          "description": "Their title"
        },
        "confirm": {
          "type": "boolean",
          "description": "true only after the person has explicitly approved"
        },
        "email": {
          "type": "string",
          "description": "For an NDA with real e-signature: the signer's email, where the NDA is sent to sign"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "breakout_id",
        "decision",
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "vendor_read_sources",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Have the language model read your sources again and map them onto the vocabulary, for one asset or all. Every claim it returns must quote a line that is really in your sources, or it is dropped. Claims wait for your review; capabilities the vocabulary lacks are proposed to RFX. It also runs by itself a few seconds after your sources change.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "An asset id; default: every active asset"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_list_assets",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Your assets: the main product (from your listing) and any other product or service you added, each with its category, status, number of claims and how many await review.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_add_asset",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Add another product or service your company offers, in a category from list_capabilities. Then add its documents with vendor_add_documents({asset}); RFX reads them for that asset only, and a person reviews the claims.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "What it is called"
        },
        "kind": {
          "type": "string",
          "enum": [
            "product",
            "service"
          ]
        },
        "market": {
          "type": "string",
          "description": "Its category, e.g. crm. Default: your listing's category"
        },
        "description": {
          "type": "string",
          "description": "One or two sentences"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "name"
      ]
    }
  },
  {
    "name": "vendor_update_asset",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Rename an asset you added, change its description or category, or retire it (status retired: buyers no longer see it). The main product follows your listing.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "Asset id"
        },
        "name": {
          "type": "string",
          "description": "New name"
        },
        "description": {
          "type": "string",
          "description": "New description"
        },
        "market": {
          "type": "string",
          "description": "New category"
        },
        "status": {
          "type": "string",
          "enum": [
            "active",
            "retired"
          ]
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "asset"
      ]
    }
  },
  {
    "name": "vendor_remove_asset_terms",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Sell one of your other products on the company's terms again, dropping the terms set for it alone.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "Asset id"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "asset"
      ]
    }
  },
  {
    "name": "vendor_get_deal",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Read one of your deals. Once both agents agree, the terms and the agreement stay hidden until your company pays the lead fee.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Deal id"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "deal_id"
      ]
    }
  },
  {
    "name": "vendor_pay_lead_fee",
    "level": "Vendor",
    "auth": "vendor",
    "description": "HUMAN ONLY, vendor. Pay the lead-generation fee for a deal both agents agreed, to see its terms and sign it. When RFX takes payments through Stripe, the answer carries checkout.url: give it to the person, who pays there; the terms open once Stripe confirms. Otherwise the payment is a mock. Pass the name of the person paying and confirm: true only after they approved.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Deal id"
        },
        "name": {
          "type": "string",
          "description": "The person deciding"
        },
        "title": {
          "type": "string",
          "description": "Their title"
        },
        "confirm": {
          "type": "boolean",
          "description": "true only after the person has explicitly approved"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "deal_id",
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "vendor_pay_introduction_fee",
    "level": "Vendor",
    "auth": "vendor",
    "description": "HUMAN ONLY, vendor. Pay what is due on an introduction: the introduction fee (due when an NDA with a buyer is signed by both, before you can open negotiation with that buyer), or the fee for an agreement made with that buyer outside RFX. When RFX takes payments through Stripe, the answer carries checkout.url, the page where the person pays; otherwise the payment is a mock.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "introduction_id": {
          "type": "string",
          "description": "From list_introductions"
        },
        "name": {
          "type": "string",
          "description": "The person deciding"
        },
        "title": {
          "type": "string",
          "description": "Their title"
        },
        "confirm": {
          "type": "boolean",
          "description": "true only after the person has explicitly approved"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "introduction_id",
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "list_introductions",
    "level": "Trust",
    "auth": "party",
    "description": "Your introductions: when RFX first revealed a buyer and a vendor to each other (when an NDA between them was started), until when the 24-month non-circumvention runs, the NDAs and deals that followed, and, for a vendor, the fees due.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "buyer_token": {
          "type": "string",
          "description": "If you are a buyer and cannot send the Authorization header"
        },
        "vendor_key": {
          "type": "string",
          "description": "If you are a vendor and cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_sign",
    "level": "Vendor",
    "auth": "vendor",
    "description": "HUMAN ONLY, vendor. Sign a deal both agents agreed, once the lead fee is paid. Mock signature, not binding.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Deal id"
        },
        "name": {
          "type": "string",
          "description": "The person deciding"
        },
        "title": {
          "type": "string",
          "description": "Their title"
        },
        "confirm": {
          "type": "boolean",
          "description": "true only after the person has explicitly approved"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "deal_id",
        "name",
        "confirm"
      ]
    }
  },
  {
    "name": "vendor_get_perimeter",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. The perimeter your agent works inside: commercial, technical, legal, and who decides what falls outside it.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "asset": {
          "type": "string",
          "description": "For one of your other products: its asset id. Without it, the company's terms, which every product without its own uses"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  },
  {
    "name": "vendor_set_perimeter",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. Replace the perimeter. Read it first with vendor_get_perimeter and send back the full object with your changes.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "perimeter": {
          "type": "object"
        },
        "asset": {
          "type": "string",
          "description": "For one of your other products: its asset id. Without it, the company's terms, which every product without its own uses"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": [
        "perimeter"
      ]
    }
  },
  {
    "name": "vendor_trail",
    "level": "Vendor",
    "auth": "vendor",
    "description": "Vendor. The hash-chained record of everything agents and people did on your deals.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "deal_id": {
          "type": "string",
          "description": "Optional: one deal"
        },
        "vendor_key": {
          "type": "string",
          "description": "Vendor key, if you cannot send the x-vendor-key header"
        }
      },
      "required": []
    }
  }
]