Agent access — API & MCP

The audit isn't just for people. An AI agent can run it directly — over a documented REST endpoint or the Model Context Protocol.

MCP server

The MCP endpoint is a stateless Model Context Protocol server (Streamable HTTP transport). Point an MCP-compatible client at:

https://futureproofwebsite.com/mcp

It exposes two tools:

Example handshake and tool call (JSON-RPC 2.0 over HTTP POST):

curl -s https://futureproofwebsite.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-06-18","capabilities":{},
                 "clientInfo":{"name":"demo","version":"1.0"}}}'

curl -s https://futureproofwebsite.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"audit_site","arguments":{"url":"https://example.com"}}}'

REST endpoint

For non-MCP clients, the same audit is available as JSON:

GET https://futureproofwebsite.com/api/audit?url=https://example.com

Returns the full scored result — per-pillar scores, each criterion's status and detail, and the criteria flagged for manual review.

A2A endpoint

For agent-to-agent clients, an Agent2Agent endpoint accepts a JSON-RPC message/send carrying a URL and returns the audit as a completed task (text summary plus the full result as a structured artifact):

POST https://futureproofwebsite.com/a2a

Discover it from the agent card at https://futureproofwebsite.com/.well-known/agent-card.json.

Authentication & limits

Open by design: agents may call /api/audit, /mcp and /a2a anonymously, within a per-client rate limit — enough for trying it, low-volume use, and agent traffic. For production, higher volume, or partner use, request an API key and send it as a bearer token:

curl -H 'Authorization: Bearer fpw_sk_live_…' \
  'https://futureproofwebsite.com/api/audit?url=https://example.com'

A key raises your rate limit and returns the enriched (premium) result. Keys are server-side only — never expose one in browser or client-side code. To request a key, get in touch; use of the API is subject to the Acceptable Use Policy.

Notes