MCP server Auto Agent Protocol

Auto Agent Protocol 3.2

One open automotive contract for MCP, A2A and Personal Agent Protocol. Discover dealerships, search real inventory, verify vehicle facts and send customer-approved inquiries.

Website · Specification · FAQ · Migration · Full spec for agents

Native in all three interfaces

Interface	Native operation	Automotive contract
MCP	Streamable HTTP tools; current 2026-07-28 and 2025-11-25 compatibility	Typed arguments, complete schemas and structured results
A2A 1.0	SendMessage with the required AAP extension	The same payload in DataPart.data
PAP 0.3	Delegated Poppy-Session JWTs and native OpenAPI	The same request and response bodies

A full AAP 3.2 dealer deployment serves its implemented skill subset through all three. A buyer client needs only its chosen binding. AAP does not require a dealer-side language model or a new CRM.

A working MCP endpoint is required. The generated mcp.json catalog describes tools; it is not a server. See conformance and runtime acceptance.

Discovery starts at the dealership

Dealer-domain resource	What it tells an agent
/.well-known/agent-card.json	A2A endpoint, selected AAP contract, skills, search capabilities and MCP/PAP links
/.well-known/poppy.json	PAP identity, optional issuer, native API and matching AAP discovery links
/llms.txt	Exact service URLs, access requirements, documentation and inventory links

The service may run on a provider’s infrastructure. Every entry point identifies the same dealership and actual capabilities. Discovery helps compatible agents find a service; it does not guarantee that every assistant will choose it.

Start from the Agent Card, Poppy document and dealer llms.txt. These release-pinned templates use fictional dealers: replace their identity, URLs and capabilities before deployment. Discovery requirements →

Five skills, one automotive journey

Dealer information · Facets · Search · Vehicle detail · Lead submission

Browse without shopper contact details. Submit a lead only with explicit consent, permitted channels and an idempotency key. A received inquiry and a confirmed appointment are separate outcomes.

What is new in 3.2

• Published PAP 0.3: a fresh delegated Poppy-Session JWT authenticates each API request. Signed-out shopping needs no guest OAuth token.
• Verified Company identity: domain protected-resource discovery selects an issuer when one exists. An existing issuer can remain in place with sign-in disabled.
• Explicit recovery: invalid or ended Sessions return HTTP 400 with safe recovery guidance. Session continuity survives delegated-key rotation.
• Preserved automotive behavior: currency, odometer units, pricing, equipment evidence, consent, MCP, A2A and bridge version 1 retain their meanings.

This is a maintainer-approved minor exception with required PAP client migration. Frozen AAP 3.1 uses an incompatible earlier draft also labeled 0.3; its endpoints and artifacts remain unchanged. Update authentication and client constructors together, verify the new deployment, then switch discovery. The next AAP major is reserved for PAP 1.0. Migration guide →

Automotive detail, shared across vehicle types

Known prices include mandatory dealer charges; only government-required consumer charges are excluded. Optional fee itemization explains the existing total. Unknown equipment and prices stay unknown.

Vehicle shape · Pricing · Consent and behavior · CRM / ADF mapping

Payments, financing approval, reservations and trade-in valuations are outside AAP’s scope.

Use the packages

npm install @autoagentprotocol/schemas@3.2.0 @autoagentprotocol/types@3.2.0 @autoagentprotocol/validator@3.2.0

Artifact	Reference
JSON Schema 2020-12	spec/v3.2/schemas/
Typed and wire examples	spec/v3.2/examples/
MCP tool catalog	/v3.2/mcp.json
A2A JSON-RPC OpenAPI	/v3.2/openapi-jsonrpc.yaml
PAP OpenAPI	/v3.2/openapi-poppy.yaml
Immutable release registry	releases.json

Build and verify

Use Node.js 22+ and the pnpm 10 version pinned in package.json. Corepack and recent pnpm launchers select that version automatically; both CI workflows use the same pin. Run heavy checks one at a time.

pnpm install --frozen-lockfile
pnpm validate
pnpm test:contract
pnpm typecheck
pnpm build

Official MCP and A2A clients exercise real HTTP contract fixtures. PAP checks cover discovery, identity, session schemas and generated OpenAPI. These validate the specification; each production deployment must also verify live authentication, inventory, consent and CRM behavior.

See all verification commands, release preparation and visual generation.

Path	Purpose
spec/latest/, docs/	Editable contract and documentation
docs/img/	Reproducible SVG diagrams; pnpm generate:images
spec/v*/, versioned_docs/	Immutable release snapshots
releases/v*/	Generated artifacts, provenance and integrity
packages/	Schemas, types and validator packages
src/	Website and interactive explanations
tools/	Generators, validation and release checks

/latest machine artifacts follow the stable registry. /docs/latest is editable documentation and may describe a future release. Pin the advertised version for an integration.

Contribute

Contribution guide · Security reports · Code of conduct · Brand assets

Specification, schemas and code: Apache-2.0. Documentation prose: CC BY 4.0.