# Auth.md

Agent authentication for **Kipra Rent A Car** (kiprarent.com). This document
tells AI agents how to register and authenticate against the Kipra MCP
server. Format follows the auth.md convention (https://workos.com/auth-md).

## What you get

A remote [MCP](https://modelcontextprotocol.io) server with live, read-only
tools for a real car-rental fleet in North Cyprus (Gazimağusa / Famagusta):

- `check_car_availability` — cars actually available for a pickup/return
  window, with total prices (insurance + VAT included) in EUR/TRY and
  converted totals in USD/GBP
- `get_fx_rates` — the EUR-base rates the booking engine uses
- `get_booking_link` — a prefilled booking URL; no credit card or deposit is
  required to book, so the human completes the reservation in seconds
- `list_prices` — the current price list without dates: daily rates per
  category and rental-length tier, add-ons, one-time location fees
- `next_available` — the soonest window a car is free for a given number
  of days
- `company_info` — staff-written company knowledge base: contact and hours,
  locations, rental terms, insurance, driver requirements, payment, FAQ

- **MCP endpoint:** POST https://mcp.kiprarent.com/mcp (streamable HTTP,
  stateless JSON mode)
- **Server card:** https://www.kiprarent.com/.well-known/mcp/server-card.json

## Registration (RFC 7591 dynamic client registration)

No manual signup. Register a client at:

```
POST https://mcp.kiprarent.com/register
Content-Type: application/json

{
  "client_name": "<your agent name>",
  "redirect_uris": ["<your callback URL>"],
  "token_endpoint_auth_method": "none",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"]
}
```

The response contains your `client_id`. Public clients (`none` auth method)
are accepted; PKCE is mandatory.

## Authorization (OAuth 2.1, authorization code + PKCE)

- Authorization endpoint: https://mcp.kiprarent.com/authorize
- Token endpoint: https://mcp.kiprarent.com/token
- Scope: `availability.read` (read-only; no personal data is accessible)
- PKCE: `S256` only
- Consent: a human clicks Approve once on the hosted consent page; tokens
  expire after 1 hour and refresh via `refresh_token`

Machine-readable metadata:

- https://mcp.kiprarent.com/.well-known/oauth-authorization-server (RFC 8414;
  also mirrored at https://www.kiprarent.com/.well-known/oauth-authorization-server
  with an `agent_auth` extension block)
- https://mcp.kiprarent.com/.well-known/oauth-protected-resource (RFC 9728)

## Revocation

Tokens are short-lived (3600 s). Refresh tokens can be revoked at the token
endpoint (revocation_endpoint: https://mcp.kiprarent.com/token).

## Notes for agents

- Booking is a **handoff**, not an API write: `get_booking_link` returns a
  prefilled https://app.kiprarent.com/book/cars URL. No payment happens
  online; the site never asks for card details.
- Dates are Cyprus local time (Europe/Nicosia), format `YYYY-MM-DDTHH:mm`.
- Company facts, policies and public REST endpoints: https://www.kiprarent.com/llms.txt
- Contact: info@kiprarent.com