# YouSpot docs for developers and agents

> The MCP server, OAuth 2.1, the HTTP endpoints, and the discovery files that describe them.

## Pages

- [YouSpot for developers and agents](https://youspot.com/docs/overview.md): What YouSpot exposes to code: an MCP server, OAuth 2.1, public profile endpoints, and the discovery files that describe them.
- [Authentication](https://youspot.com/docs/authentication.md): YouSpot is an OAuth 2.1 authorization server for agents: dynamic client registration, PKCE S256, refresh-token rotation. Members can also mint a long-lived API token by hand.
- [MCP server](https://youspot.com/docs/mcp.md): Connect Claude, ChatGPT, Cursor or Claude Code to https://youspot.com/mcp/v1 and let an agent read and write your own CRM.
- [HTTP API](https://youspot.com/docs/api.md): The endpoints YouSpot answers over plain HTTP: public profile data with no auth, and the MCP tool surface with a bearer token.
- [Security and vulnerability disclosure](https://youspot.com/docs/security.md): How to report a security issue to YouSpot, Inc., what is in scope, and what we commit to in return.

## Machine endpoints

- [llms.txt](https://youspot.com/llms.txt): this site, for language models
- [llms-full.txt](https://youspot.com/llms-full.txt): the long-form version
- [sitemap.xml](https://youspot.com/sitemap.xml): every public page with a last-modified date
- [index.md](https://youspot.com/index.md): the home page as markdown
- [agents.md](https://youspot.com/agents.md): what an agent can do here, in one page
- [MCP server](https://youspot.com/mcp/v1): streamable HTTP; initialize and tools/list need no credential
- [MCP server card](https://youspot.com/.well-known/mcp/server-card.json): the endpoint, transport and every tool
- [auth.md](https://youspot.com/auth.md): how an agent gets a credential
- [OpenAPI 3.1](https://youspot.com/openapi.json): every HTTP endpoint that exists
- [API catalog](https://youspot.com/.well-known/api-catalog): RFC 9727
- [agent index](https://youspot.com/v1): every endpoint, and what each one costs in credentials
- [docs MCP server](https://youspot.com/mcp/docs): the public pages over MCP, no credential at all
- [ask](https://youspot.com/ask): a question in plain words, answered from these pages
- [A2A agent card](https://youspot.com/.well-known/agent-card.json): JSON-RPC at /a2a
- [OAuth 2.1 authorization server metadata](https://youspot.com/.well-known/oauth-authorization-server): RFC 8414
- [protected resource metadata](https://youspot.com/.well-known/oauth-protected-resource): RFC 9728
- [Agent Skills index](https://youspot.com/.well-known/agent-skills/index.json): skills an agent can load
- [ARD catalog](https://youspot.com/.well-known/ard.json): agent resource discovery
- [security.txt](https://youspot.com/.well-known/security.txt): how to report a vulnerability