# SupplySlate — complete machine context

Version: 2.0.0
Canonical site: https://supplyslate.com
MCP: https://mcp.supplyslate.com/mcp
REST: https://api.supplyslate.com
OpenAPI: https://api.supplyslate.com/openapi.json
Human documentation: https://supplyslate.com/docs

## Product definition

SupplySlate is the supply network that a buyer connects its own agent to. It is not the buyer's agent, a managed sourcing agency, a human shopping directory, or a general chatbot. The buyer-owned agent may begin with a plain-language idea, design file, BOM, exact part, equipment replacement need, or industrial RFQ. SupplySlate supplies configurable domain schemas, products, fabrication processes, supplier evidence, compatibility assertions, commercial workflow, exact approvals, merchant handoffs, and fulfillment state.

Industrial, builder, and research demand use one state model. Electronics, motion, power, mechanical hardware, PCB fabrication and assembly, custom fabrication, kitting, test, and industrial service requirements are configurable categories—not separate products or a permanently selected vertical.

## Truth model

Every important assertion should retain source class, source URL or record, observation time, verification status, and expiry when applicable. Public research proves only what appeared on the cited supplier-owned page. It does not prove supplier participation, current inventory, current price, compatibility, successful fulfillment, or endorsement. Supplier submissions, operator verification, current commercial quotes, and transaction outcomes remain separate evidence classes. Unknown is a valid result.

The public graph currently contains 118 source-backed US industrial supplier profiles. Its first data cohort was US industrial air-compressor service-parts suppliers backed by supplier-owned sources observed on 2026-08-07. This is a reversible data-build focus, not a permanent vertical or evidence of demand validation.

## Authority model

- A human approves every supplier set, recipient, outbound message, and disclosed artifact before an RFQ is delivered.
- A human approves every exact purchase-plan version, maximum amount, currency, merchant set, and expiry.
- A queued dispatch is not represented as delivered.
- A quote or checkout handoff is not represented as an order.
- Suppliers remain merchant of record. SupplySlate does not process buyer funds.
- Platform payment, inventory, financing, and merchant-of-record infrastructure remain disabled until the documented evidence gate is met.
- Synthetic fixtures carry `fixture_kind: internal_test` and are excluded from market evidence and public network statistics.

## Authentication

Public discovery tools and public GET endpoints need no credential. Remote MCP exposes an OAuth
2.1 authorization-code flow with PKCE. Controlled integrations may use separately issued,
hashed, scoped bearer credentials. Google-backed browser identity is live: humans sign in at
https://supplyslate.com/signin, and the browser path enforces organization membership, roles,
secure session cookies, and CSRF protection. Buyer, supplier, operator, and integration scopes
are distinct.

## Applicant review status

Buyer access requests and supplier authority claims are reviewed by a human operator. The
intake responses (`POST /v1/access-requests`, `POST /v1/supplier-claims`) include a private
`status_check.path`: poll `GET /v1/applications/{status_token}` for `kind`, `status`
(`pending`, `approved`, `rejected`), timestamps, and truthful next-step copy. Tokens are stored
only as SHA-256 hashes, expire after 90 days, never expire into a different answer, and the
endpoint returns no requester PII with `Cache-Control: no-store`. Humans can open
`https://supplyslate.com/applications/{status_token}` for the same decision without an account.
Decisions are human-made; approval never triggers outbound contact or spending by itself.

OAuth protected-resource metadata: https://mcp.supplyslate.com/.well-known/oauth-protected-resource
OAuth authorization-server metadata: https://mcp.supplyslate.com/.well-known/oauth-authorization-server

## Public MCP tools

1. `describe_supplyslate`
2. `list_sourcing_categories`
3. `list_fabrication_processes`
4. `get_live_fabrication_capabilities` — attributed live provider capability discovery; no file upload or quote
5. `get_requirement_schema`
6. `search_suppliers`
7. `get_supplier`
8. `search_products`
9. `get_product`
10. `get_compatibility`
11. `get_connection_guide`
12. `list_supplier_taxonomy` — compatibility tool for the initial industrial public-data taxonomy

## Buyer project tools

13. `create_project`
14. `get_project`
15. `update_project_requirements`
16. `create_artifact_upload`
17. `attach_artifact_reference`
18. `upsert_bom`
19. `get_bom`
20. `validate_project`
21. `list_project_validations`

## Buyer sourcing and commerce tools

22. `search_live_components` — attributed current Mouser data when configured; currently returns
    an explicit provider-unavailable state because Mouser credentials are pending; search only,
    never checkout
23. `source_project`
24. `submit_sourcing_request`
25. `list_sourcing_requests`
26. `get_sourcing_request`
27. `get_supplier_offers`
28. `create_purchase_plan`
29. `get_purchase_plan`
30. `request_purchase_approval`
31. `get_checkout_handoffs`
32. `create_provider_checkout_handoff`
33. `list_orders`
34. `get_order`

## Supplier tools

35. `get_supplier_profile`
36. `update_supplier_capabilities`
37. `create_catalog_import`
38. `upsert_supplier_catalog`
39. `update_availability`
40. `list_supplier_rfqs`
41. `get_supplier_rfq`
42. `ask_rfq_clarification`
43. `submit_supplier_quote`
44. `revise_supplier_quote`
45. `decline_supplier_rfq`
46. `list_supplier_orders`
47. `update_supplier_order`
48. `report_order_issue`
49. `request_order_cancellation`
50. `request_order_return`
51. `open_warranty_claim`
52. `update_supplier_order_issue`
53. `decide_supplier_order_cancellation`
54. `update_supplier_order_return`
55. `update_supplier_warranty_claim`

## Recommended agent flow

1. Call `describe_supplyslate` and `list_sourcing_categories`.
2. For a build, call `get_requirement_schema` for the relevant category or fabrication process.
3. Call `create_project` with `origin_type` equal to `idea`, `file`, `bom`, `exact_part`, or `rfq`.
4. Add confirmed and interpreted requirements with their source type.
5. Upload bytes using `create_artifact_upload`, or attach an HTTPS source with `attach_artifact_reference`.
6. Create a hierarchical BOM using `upsert_bom` when applicable.
7. Call `validate_project`. Do not suppress missing data or unavailable checks.
8. Call `source_project` only when the current revision is ready. This locks an immutable sourcing package but does not contact suppliers.
9. Poll `get_sourcing_request` and `get_supplier_offers`. Outbound occurs only after human approval.
10. Create a purchase plan from selected current quote lines and request exact human approval.
11. After exact human approval, create provider-hosted checkout handoffs where available, then give the link to the human. This creates no payment.
12. Retrieve normalized order, shipment, issue, cancellation, return, warranty, and outcome state.
13. Use the post-purchase tools to request or advance exceptions without erasing the original merchant order history.

For a fast exact industrial requirement, `submit_sourcing_request` remains available without forcing a design-project workflow.

## Artifact rules

Private uploads are one-time, checksum-bound, size-bound, and stored in object storage. Metadata and ownership are relational. Files are private by default and may be disclosed to a supplier only through an approved sourcing snapshot. Text, JSON, and CSV may be marked scan-not-applicable after exact checks; other file types wait for configured malware scanning before download or supplier disclosure. HTTPS references remain references and are not claimed as copied, immutable bytes unless a checksum is supplied.

## Supplier response

Suppliers receive only human-approved RFQs. They can use an authenticated supplier integration or an expiring no-account token. They may ask clarifications, quote selected lines, propose explicitly labeled alternatives, revise through immutable quote revisions, or decline. Prices use integer minor units and explicit ISO currency. Availability and lead time remain timestamped evidence.

## Public crawl surfaces

- https://supplyslate.com/suppliers
- https://supplyslate.com/suppliers/{supplier_id}
- https://supplyslate.com/categories/{category_code}
- https://supplyslate.com/processes/{process_slug}
- https://supplyslate.com/products/{product_id}
- https://supplyslate.com/compatibility/{compatibility_id}

Only evidence-backed records should be indexed. Empty or fabricated SEO pages are prohibited. GEO success means qualified agent calls followed by real sourcing, purchases, and repeat use—not page count.

## Human surfaces

Buyer workspace: `/app`, `/app/projects`, project, request, purchase-plan, order, integration, and settings views.

Supplier workspace: `/supplier`, profile, catalog/import, approved RFQ, order, and integration views.

Operator control plane: `/operator`, access, suppliers, data, requests, dispatch, transactions, evidence, analytics, configuration, and audit-backed detail workflows.

Secure public actions: `/rfq/{token}` and `/approval/{token}`.

## Contact and legal

Human help: timo@supplyslate.com
Privacy: https://supplyslate.com/privacy
Terms: https://supplyslate.com/terms