# SPACEXPLORATION

> Commercial real estate listings, built for AI agents. Search and inspect CRE listings over a Model Context Protocol (MCP) server — the read tools work anonymously, no token or API key needed. Saving searches and authoring listings use OAuth + PKCE with Dynamic Client Registration, so even credentials are self-serve. Listing pages and the sitemap are openly crawlable.

The MCP server is the primary surface for agents. Searching needs no setup at all: connect anonymously and call the read tools. Account-bound tools (saved searches, geocoding, listing authoring) take one frictionless OAuth flow: clients register themselves (RFC 7591 Dynamic Client Registration) and authorize with OAuth 2.0 Authorization Code + PKCE — no human provisions a key. Everything shares one `mcp:use` scope; writes are additionally gated on owning the underlying listing.

## MCP server (start here)

- [MCP endpoint](https://sitemaps.spacexploration.com/mcp): Streamable-HTTP MCP server. Read tools work anonymously: `get_registry`, `search_listings`, `get_listing`, `interpret_search`. Account-bound tools need a bearer token — the endpoint advertises its authorization server via RFC 9728 protected-resource metadata and supports Dynamic Client Registration, so compliant clients connect with no manual setup. Authoring tools (your own listings): `geocode_address`, `create_listing`, `update_listing`, `set_listing_attributes`, `attach_listing_photo`, `sign_attachment_upload`, `confirm_attachment_upload`, `delete_attachment`, `publish_listing`, `get_pipeline_status`, `withdraw_listing`. Saved searches: `save_search`, `list_my_saved_searches`, `delete_saved_search`, `list_my_listings`.
- [Server manifest](https://sitemaps.spacexploration.com/.well-known/mcp/server.json): MCP registry `server.json` for this server.
- [Agent registration skill](https://sitemaps.spacexploration.com/auth.md): `auth.md` — step-by-step credential walkthrough for agents: browser OAuth (Dynamic Client Registration → Authorization Code + PKCE), or a headless verified-email claim ceremony (relay a 6-digit code to the user, poll for tokens).
- Recommended search flow: call `get_registry` for the filterable attribute schema (field names, types, allowed values), then `search_listings` with structured filters — or hand a natural-language query to `interpret_search` to get those filters back first. `get_listing` takes a hashid for the full projection.
- Recommended authoring flow: `geocode_address` (turns an address string into the coordinates + county `create_listing` needs) → `create_listing` (returns the full listing incl. its hashid) → `update_listing` (pricing/marketing/parcel) → `set_listing_attributes` (the rich registry fields — pass a map of field name to value; only the fields `get_registry` marks `writable: true`, e.g. `attr_parking_spaces`, `attr_office_class`; the rest are computed at publish) → `attach_listing_photo` (one call per image URL; the server fetches and ingests it) → `publish_listing` (asynchronous — then poll `get_pipeline_status` with the listing hashid until its state is `completed`). Everything is keyed by the listing hashid; the numeric id is never needed. Authoring requires a verified email.

## Open data (no auth)

- [Search](https://sitemaps.spacexploration.com/listings): Human-facing search UI. Every listing has a stable, citable permalink.
- [Sitemap](https://sitemaps.spacexploration.com/sitemap.xml): All publicly visible listings with last-modified timestamps.