RFP Response Checker

RFP Response Checker checks whether a supplier RFP response addresses each requirement explicitly stated by the buyer.

Current Gate

This repository currently implements Gate 3: Review Shell + Deploy. It includes the Cloudflare Workers TypeScript project, independent review pages, the MCP endpoint, Tool contracts, deterministic local Tool runtime logic, structured success/error output, local MCP regression tests, and a production MCP regression entry point.

It has not entered Scan Tools, Developer Mode connection for a formal Worker, OpenAI submission, or review-material preparation.

Related MCP server: Behavioral Audit MCP

Frozen Tool List

1. extract_rfp_requirements

2. check_rfp_response_coverage

No other tools are exposed.

Architecture

• Cloudflare Workers

• TypeScript

• POST /mcp

• JSON-RPC 2.0

• Read-only

• Stateless

• No login

• No OAuth

• No database

• No external API calls

• No external side effects

Required Routes

• GET / returns a minimal informational HTML page.

• GET /privacy returns the privacy page.

• GET /terms returns the terms page.

• GET /support returns the support page.

• GET /health returns stable JSON health information.

• GET /.well-known/openai-apps-challenge returns the configured challenge value as plain text when OPENAI_APPS_CHALLENGE is set.

• POST /mcp is the only MCP endpoint.

• Unknown routes return a clear 404 response.

• Unsupported methods do not enter MCP logic unless the path is POST /mcp.

Local Setup

Install dependencies:

npm install

Run the local Worker:

npm run dev

Run TypeScript checking:

npm run typecheck

Run the local MCP regression suite:

npm run test:mcp:local

The regression script starts a local Worker, calls the local MCP URL, validates route behavior, checks the review pages and challenge route, checks MCP methods, exercises both frozen tools, and validates structuredContent against the corresponding output schemas with AJV.

Run production MCP regression after deployment:

PRODUCTION_BASE_URL=<production-worker-url> npm run test:mcp:production

If a real challenge value has been configured securely in the Worker environment, pass it only through the local shell environment for verification:

PRODUCTION_BASE_URL=<production-worker-url> OPENAI_APPS_CHALLENGE_EXPECTED=<expected-value> npm run test:mcp:production

Deterministic Rules

Requirement extraction uses deterministic text rules. It recognizes explicit requirement language such as must, shall, required, is required, are required, should, needs to, and need to, plus standalone request-style bullet lines beginning with verbs such as provide, include, submit, describe, explain, list, identify, demonstrate, and confirm.

Duplicate requirements are removed using normalized requirement text. Requirement IDs are assigned in stable order as REQ-001, REQ-002, and so on.

Coverage checks compare extracted requirements against the supplied response text using deterministic token matching and simple negation handling. The output is an auxiliary text coverage check only. It is not legal advice, compliance advice, or a bid-success guarantee, and it cannot guarantee complete semantic coverage.

Support

Support Email: sidcraigau@gmail.com