Generic and cloud MCP clients - AutoFire Docs

Connection values

Setting	Value
Transport	Streamable HTTP
URL	`https://mcp.goautofire.com/mcp`
Authentication	OAuth 2.1 sign-in, or HTTP bearer token
Header (bearer)	`Authorization: Bearer <key>`
OAuth discovery	`https://mcp.goautofire.com/.well-known/oauth-protected-resource/mcp`

AutoFire also accepts the legacy stateless HTTP flow for compatibility. New integrations should use Streamable HTTP.

OAuth clients

Any client that implements the MCP authorization flow works without configuration: it reads the protected-resource metadata, registers itself dynamically, and sends the user to AutoFire’s consent screen. PKCE S256 is required. Request the email scope or none; AutoFire permissions are chosen on the consent screen.

Client checklist

Confirm the client supports a remote HTTP MCP server with OAuth sign-in or a custom bearer header.
If you use a key, store it in the client’s encrypted secret store, not a prompt or shared config file.
Disable tools the workflow does not require.
Keep interactive approval enabled during validation.
Test with inventory before considering lead permissions.
Review where the client stores prompts, tool arguments, and tool results.

Hosted cloud clients

A hosted client may transmit dealership data outside AutoFire’s infrastructure. Confirm the provider’s subprocessor list, region, retention period, model-training controls, incident response, and deletion process before connecting it.

Desktop extensions

The former DXT packaging format is now commonly called an MCP Bundle (MCPB). AutoFire is a hosted server and does not require a local MCPB installation; configure the remote URL instead.