AutoFire

AutoFire automotive MCP

An automotive MCP server built for car dealerships

Give approved AI clients read-only access to one dealership’s inventory and workflows. AutoFire never gives the client a database password or service-role key.

Create an MCP keyRead the quickstart
.codex/config.tomlStreamable HTTP
[mcp_servers.autofire]
url = "https://mcp.goautofire.com/mcp"
bearer_token_env_var = "AUTOFIRE_MCP_TOKEN"
required = true
tool_timeout_sec = 30

Available tools

What AutoFire MCP lets your dealership do

Search inventory, review lead statuses, check test-drive records, and read recent dealership reports from an MCP client. Each key exposes only the tools and data permissions selected by a dealership owner or admin.

Want to see the day-to-day dealership workflows first? Read how dealership owners use AutoFire MCP.

Dealership profile

Public business profile, verified website, hours, and location.

Inventory search

Search up to 50 dealership-owned vehicles per request without exposing VINs.

Lead workflow

Review lead statuses and linked vehicles without contact details by default.

Scoped lead details

Return a single lead’s contact data only with the explicit leads:pii scope.

Test drives

Read scheduling workflow and vehicle context without customer identity or notes.

Aggregate insights

Retrieve recent dealership reports without customer-level records.

More MCP features are rolling out soon. Have something specific in mind? Contact us.

Connect dealership inventory and leads to AI tools

AutoFire exposes focused operations instead of a general SQL or table API. Queries are parameterized, paginated, size-limited, and filtered to the dealership encoded in the credential.

  1. 1Choose the dealership in the AutoFire dashboard.
  2. 2Create a named 30-, 60-, or 90-day key with least-privilege scopes.
  3. 3Store the key in the client’s secret or environment-variable manager.
  4. 4Connect to the Streamable HTTP endpoint and verify the advertised tools.

Access controls

Limit every connection with expiring, scoped keys

Personal access keys work with headless and local clients. AutoFire will advertise the OAuth 2.1 resource-server option only after the production Supabase OAuth and asymmetric signing rollout is verified.

✓ One dealership per credential
✓ Raw key displayed once
✓ Immediate server-side revocation
✓ Per-source, key, dealer, and tool limits
✓ Security activity logged without copying customer details
✓ 128 KiB request ceiling and strict schemas
✓ No arbitrary URLs or database queries
✓ Read-only launch toolset

Works with Codex, Claude Code, and cloud-compatible clients

Use the same HTTPS endpoint with a separate credential per client. Each guide includes client-specific configuration and verification steps.

Codex →

Shared configuration for Codex CLI, the IDE extension, and the desktop app.

Claude Code →

Remote HTTP setup, project/user scope, and authorization-header guidance.

Client compatibility →

Compare connection methods for local, hosted, and generic MCP clients.

Automotive MCP FAQ

Can one key access several dealerships?

No. Every key is permanently bound to one dealership. Create a separate key for each dealership connection.

Does AutoFire store the raw MCP key?

No. The dashboard shows it once, then stores only an HMAC-SHA-256 digest.

Can an AI client change inventory or lead records?

Not in the initial release. Every published tool is read-only and annotated as non-destructive.

How long can a key remain active?

Owners and admins choose 30, 60, or 90 days. Keys cannot be extended and can be revoked immediately.

Connect your dealership without exposing the whole database

Start with a 30-day, read-only key and only the scopes your client needs.

Open MCP & API