{
  "$schema": "https://modelcontextprotocol.io/schema/server-card.json",
  "name": "vendorkeep",
  "displayName": "VendorKeep",
  "description": "Vendor compliance system of record for finance teams. Full vendor lifecycle (W-9, IRS TIN matching, contracts, 1099 filing) with six built-in agents and an MCP surface for any AI client.",
  "version": "2026.5.0",
  "publisher": {
    "name": "VendorKeep",
    "url": "https://vendorkeep.ai",
    "contact": "mailto:hello@vendorkeep.ai"
  },
  "homepage": "https://vendorkeep.ai/developers",
  "documentation": "https://vendorkeep.ai/developers",
  "license": "Proprietary",
  "transports": [
    {
      "type": "streamable-http",
      "url": "https://api.vendorkeep.ai/mcp",
      "specVersion": "2025-06-18"
    }
  ],
  "authentication": {
    "type": "oauth2",
    "version": "2.1",
    "features": ["pkce", "dynamic-client-registration", "audience-binding-rfc-8707"],
    "authorizationServerMetadata": "https://api.vendorkeep.ai/.well-known/oauth-authorization-server",
    "protectedResourceMetadata": "https://api.vendorkeep.ai/.well-known/oauth-protected-resource"
  },
  "capabilities": {
    "tools": {
      "count": 60,
      "categories": [
        { "name": "vendors", "description": "List, search, get detail, classify, archive vendors. Onboarding state machine." },
        { "name": "w9", "description": "Request, status, freshness, refresh of W-9 forms." },
        { "name": "tin", "description": "TIN match status, B-Notice intake, mismatch resolution. Raw TIN values are never returned." },
        { "name": "contracts", "description": "List, get detail, redlines, renewals queue. Sign-flow state." },
        { "name": "payments", "description": "Ingest, classify, list, void payments. GL mapping. YTD spend per vendor." },
        { "name": "filing", "description": "Filing readiness scoring, generation, submission (federal + state). Submission is a destructive tool requiring human consent." },
        { "name": "compliance", "description": "Annual review lifecycle, dormant safety net, B-Notice resolution status." },
        { "name": "dashboard", "description": "Portfolio metrics, watcher activity, today's actions, signals." },
        { "name": "audit", "description": "Append-only log queries, filterable by watcher, vendor, decision, severity." }
      ]
    },
    "resources": {
      "count": 4,
      "examples": [
        "vendor://{ein_entity_id}/{vendor_id}",
        "filing://{ein_entity_id}/{tax_year}",
        "tax-year://{ein_entity_id}/{tax_year}",
        "dashboard://{ein_entity_id}"
      ]
    },
    "prompts": {
      "count": 6,
      "examples": [
        "Audit my vendor list",
        "Prepare year-end filings",
        "Find missing W-9s",
        "Show vendors with TIN mismatches",
        "Renewal report for next quarter",
        "Spend anomaly review"
      ]
    },
    "elicitation": true,
    "progressNotifications": true,
    "subscriptions": true
  },
  "safety": {
    "actionTiers": [
      { "tier": "read", "consent": "scope-only", "description": "Unrestricted within agent's OAuth scope." },
      { "tier": "mutating", "consent": "idempotency-key", "description": "Mutating tools require an idempotency key." },
      { "tier": "destructive", "consent": "human-at-call-time", "description": "Filing submission, payment voids, TIN reveal — require human consent at call time, plus optional second-admin approval." }
    ],
    "piiPolicy": "Raw TINs/SSNs/EINs never traverse MCP; masked values only.",
    "auditLogging": "Paired audit rows on every mutation (invoked / outcome) with arg-fingerprint replay protection.",
    "tenantIsolation": "Row-level by ein_entity_id (IRS EIN). Cross-tenant data is invisible.",
    "regulatoryDisclosure": "OAuth consent screen includes IRC §7216 taxpayer-information disclosure language."
  },
  "compatibility": {
    "clients": [
      "claude-desktop",
      "claude-ai",
      "chatgpt-mcp-developer-mode",
      "cursor",
      "windsurf",
      "anthropic-sdk",
      "openai-sdk"
    ]
  }
}