Connect to Florida's Private-Provider Registry

FLPPR exposes a Model Context Protocol (MCP) service over HTTPS. Building departments read registration data; private provider firms read and submit updates for their own registration. FLPPR does not expose a separate public REST API.

Development MCP URL

https://mcp.dev.flppr.app/mcp

Production MCP URL at launch

https://mcp.flppr.app/mcp

Development health check

GET https://mcp.dev.flppr.app/health

Firm administrators create keys under Firm → Settings → API Keys. Building department administrators create keys under Department → Setup → API Keys. Each key is shown once as prefix/secret.

Choose 90 days, 1 year, or no expiry. Rotate or revoke a key from the same page. Rotation revokes the old key and shows the new secret once.

Send your key in Authorization: Bearer <prefix>/<secret>. Every call to /mcp also needs the protocol, method, and content-type headers below. Add Mcp-Name for a tool call.

The service is stateless. Never send Mcp-Session-Id. You may send an optional x-request-id; otherwise FLPPR creates one.

Supported Mcp-Method values are tools/list, tools/call, prompts/list, prompts/get, resources/list, resources/read, resources/templates/list, and server/discover.

curl https://mcp.dev.flppr.app/mcp \
  --request POST \
  --header 'Authorization: Bearer <prefix>/<secret>' \
  --header 'Content-Type: application/json' \
  --header 'MCP-Protocol-Version: 2026-07-28' \
  --header 'Mcp-Method: tools/list' \
  --data '{"jsonrpc":"2.0","id":"request-1","method":"tools/list","params":{}}'

curl https://mcp.dev.flppr.app/mcp \
  --request POST \
  --header 'Authorization: Bearer <prefix>/<secret>' \
  --header 'Content-Type: application/json' \
  --header 'MCP-Protocol-Version: 2026-07-28' \
  --header 'Mcp-Method: tools/call' \
  --header 'Mcp-Name: search_firms' \
  --data '{"jsonrpc":"2.0","id":"request-2","method":"tools/call","params":{"name":"search_firms","arguments":{"query":"example","limit":25}}}'

Request
{
  "jsonrpc": "2.0",
  "id": "request-1",
  "method": "tools/list",
  "params": {}
}

Response (abbreviated)
{
  "jsonrpc": "2.0",
  "id": "request-1",
  "result": {
    "tools": [
      { "name": "search_firms" }
    ]
  }
}

Any MCP-capable client can use these tools; the key decides what the client is allowed to do. Use the first block with clients that accept Claude Desktop or Cursor-style mcpServers configuration.

{
  "mcpServers": {
    "flppr": {
      "url": "https://mcp.dev.flppr.app/mcp",
      "headers": {
        "Authorization": "Bearer <prefix>/<secret>"
      }
    }
  }
}

{
  "url": "https://mcp.dev.flppr.app/mcp",
  "headers": {
    "Authorization": "Bearer <prefix>/<secret>",
    "MCP-Protocol-Version": "2026-07-28"
  }
}

A building department key has the registry:read scope. Access is limited at the storage layer to the department that owns the key.

{
  id: UUID,
  sourceAuthority: "dbpr" | "fbpe" | "operator",
  board: string,
  licenseClass: string,
  licenseNumber: string,
  stateLabel: string,
  categories: string[] | null,
  status: string,
  issuedOn: "YYYY-MM-DD" | null,
  expiresOn: "YYYY-MM-DD" | null,
  verifiedAt: ISO datetime,
  freshness: "verified" | "stale" | "unknown",
  rulesetVersion: string
}

A firm's read key uses registry:read. The six read tools use the inputs and outputs documented above, with access narrowed as follows.

Poll get_registration_ledger. It returns newest changes first and provides a cursor for the next page. Refresh get_firm_registration for each changed firm.

HTTP 429 returns Retry-After seconds and a response body with error and auditId.

Transport Errors

JSON-RPC Errors

{
  "isError": true,
  "content": [{ "type": "text", "text": "..." }],
  "structuredContent": {
    "error": "...",
    "httpStatus": 400,
    "auditId": "flppr_aud_..."
  }
}

The MCP service returns the same registration and state licensing data available in the FLPPR portal—nothing more. See About the Data for the official sources and sync details.

Email [email protected] or choose Need help? in the app. Include the x-request-id and auditId for the failed request.