# RFP Response Checker

RFP Response Checker checks whether a supplier RFP response addresses each requirement explicitly stated by the buyer.

## Current Gate

This repository currently implements Gate 3: Review Shell + Deploy. It includes the Cloudflare Workers TypeScript project, independent review pages, the MCP endpoint, Tool contracts, deterministic local Tool runtime logic, structured success/error output, local MCP regression tests, and a production MCP regression entry point.

It has not entered Scan Tools, Developer Mode connection for a formal Worker, OpenAI submission, or review-material preparation.

## Frozen Tool List

1. `extract_rfp_requirements`
2. `check_rfp_response_coverage`

No other tools are exposed.

## Architecture

- Cloudflare Workers
- TypeScript
- `POST /mcp`
- JSON-RPC 2.0
- Read-only
- Stateless
- No login
- No OAuth
- No database
- No external API calls
- No external side effects

## Required Routes

- `GET /` returns a minimal informational HTML page.
- `GET /privacy` returns the privacy page.
- `GET /terms` returns the terms page.
- `GET /support` returns the support page.
- `GET /health` returns stable JSON health information.
- `GET /.well-known/openai-apps-challenge` returns the configured challenge value as plain text when `OPENAI_APPS_CHALLENGE` is set.
- `POST /mcp` is the only MCP endpoint.
- Unknown routes return a clear 404 response.
- Unsupported methods do not enter MCP logic unless the path is `POST /mcp`.

## Local Setup

Install dependencies:

```sh
npm install
```

Run the local Worker:

```sh
npm run dev
```

Run TypeScript checking:

```sh
npm run typecheck
```

Run the local MCP regression suite:

```sh
npm run test:mcp:local
```

The regression script starts a local Worker, calls the local MCP URL, validates route behavior, checks the review pages and challenge route, checks MCP methods, exercises both frozen tools, and validates `structuredContent` against the corresponding output schemas with AJV.

Run production MCP regression after deployment:

```sh
PRODUCTION_BASE_URL=<production-worker-url> npm run test:mcp:production
```

If a real challenge value has been configured securely in the Worker environment, pass it only through the local shell environment for verification:

```sh
PRODUCTION_BASE_URL=<production-worker-url> OPENAI_APPS_CHALLENGE_EXPECTED=<expected-value> npm run test:mcp:production
```

## Deterministic Rules

Requirement extraction uses deterministic text rules. It recognizes explicit requirement language such as `must`, `shall`, `required`, `is required`, `are required`, `should`, `needs to`, and `need to`, plus standalone request-style bullet lines beginning with verbs such as `provide`, `include`, `submit`, `describe`, `explain`, `list`, `identify`, `demonstrate`, and `confirm`.

Duplicate requirements are removed using normalized requirement text. Requirement IDs are assigned in stable order as `REQ-001`, `REQ-002`, and so on.

Coverage checks compare extracted requirements against the supplied response text using deterministic token matching and simple negation handling. The output is an auxiliary text coverage check only. It is not legal advice, compliance advice, or a bid-success guarantee, and it cannot guarantee complete semantic coverage.

## Support

Support Email: sidcraigau@gmail.com