Forwarding — v0.2 draft

• Status: draft proposal, 2026-10-24. Extends v0.1 and the registry chapter; nothing in them changes for a holder that does not ask for forwarding.
• Editors: AutoIsto s. r. o.
• Licence: CC BY 4.0 (this text, the schemas and the examples)

The key words MUST, MUST NOT, SHOULD, SHOULD NOT and MAY are to be interpreted as described in RFC 2119 and RFC 8174 when, and only when, they appear in capitals.

1. Purpose#

A person tells a general AI assistant what they want — an estate car in Lisbon under 15 000 €, a two-room flat in Brno — without knowing which holder serves that country. The assistant does not know either, and an assistant that connects to one app cannot send the person to another.

A forwarder closes that gap. It is an intent server that an assistant connects to once. It finds a holder that serves the person's country and category and has asked to receive forwarded intents, hands the wish to that holder's own server, and returns the holder's consent link. The person confirms on the holder's page, exactly as if the assistant had called the holder directly.

person ──► assistant ──► forwarder ──(intent_publish_intent)──► holder's MCP server
                              ◄────────── consentUrl on the holder's domain ◄─┘
person ──────────────────────────────────── confirms on the holder's page ──► holder

Two things follow and are the point of this chapter:

1. The buyer stays the holder's. Contact data is entered only on the holder's page. The forwarder never sees, asks for or passes on an e-mail address, a phone number or a name.
2. Nothing is forwarded to a holder that did not ask for it. Being listed in the registry is not consent to forwarding; §2 is.

2. A holder asks for forwarding#

A holder asks by adding to its descriptor (registry chapter §2):

"forwarding": {
  "accept": "requested",
  "terms": "https://istointents.org/forwarding/terms/"
}

Rules:

1. The request covers every server in the descriptor that implements the consent-link profile.
2. The registry publishes forwarding as a declared field of the entry. It is the holder's statement, like operator; the registry does not check it.
3. A holder stops forwarding by setting "accept": "withdrawn" or by removing the field. A forwarder MUST stop sending new intents within 24 hours of the registry showing the change. Intents already forwarded stay with the holder; the forwarder keeps relaying intent_get_intent, intent_list_matches and intent_withdraw_intent for them until they end.
4. A holder MAY refuse any forwarded call with a tool error. A forwarder MUST pass the refusal on to the agent and MUST NOT retry it at another holder without telling the person.

3. What a forwarder sends#

A forwarder calls the holder's intent_publish_intent with only:

1. A forwarder MUST read the holder's input schema from tools/list and MUST NOT send a property the schema does not declare.
2. A forwarder MUST NOT send contact data, conversation history, the person's location finer than the country, or anything about other people.
3. A forwarder MUST NOT keep a hidden limit after the call that passed it on.
4. A forwarder MUST NOT convert a hidden limit between currencies. If the person stated it in a currency the holder does not take, the forwarder leaves it out and tells the agent so.
5. A forwarder MUST identify itself in initialize (clientInfo.name) and in the User-Agent header with a URL that describes it, and MUST say in that description that it acts for AI agents (spec §8.3).

4. What a forwarder returns#

1. The holder's consentUrl, unchanged, and the holder's operator name and host, so that the person knows whose page they are about to open.
2. Its own code for the forwarded intent. A forwarder MUST NOT reveal the holder's intentCode to anyone; it is a bearer secret (MCP binding, profile rule 4).
3. The holder's answer otherwise unchanged: understood, notUnderstood, status and URLs of matches. A forwarder MUST NOT rewrite, reorder or filter matches.

5. Choosing a holder#

1. A forwarder considers only servers that the registry shows as active and whose countries, categories and languages fit, on hosts whose forwarding.accept is requested.
2. When more than one fits, the forwarder MUST let the person choose, naming each operator and host, or follow a preference the person stated. It MUST list them in a neutral order (by host) and MUST NOT order, include or exclude a holder for payment or for any relationship with the forwarder's operator.
3. When none fits, the forwarder MUST say so plainly. It MAY offer the person to be told when a holder starts serving their country and category (§6). It MUST NOT send the wish to a holder in another country.

6. Waiting list#

1. A waiting list is the forwarder's own service: the person confirms it on the forwarder's own page with double opt-in, under the forwarder's own privacy notice. The publish call itself takes no contact data, as in the consent-link profile.
2. When a fitting holder appears, the forwarder MAY tell the person once, with a link that starts §3 again. It MUST NOT give the person's contact or statement to the holder; the person decides.
3. A forwarder MAY publish how many confirmed wishes wait per country and category, as counts only, and only where at least 5 wait.
4. A waiting wish ends when the person withdraws it, at its buyBy date, or after 180 days.

7. Security#

1. A forwarder calls only the url of a server listed in the registry, over HTTPS on port 443, to a domain name (never an IP address), without following redirects, with a timeout of at most 10 seconds and a response limit.
2. A forwarder stores the holder's intentCode encrypted so that it cannot be read without the code the forwarder gave the agent, and deletes it when it learns the intent ended — and at the latest 200 days after publishing.
3. A forwarder MUST NOT charge holders or people for forwarding.

8. The reference forwarder#

The editors of this specification operate a forwarder at https://istointents.com/mcp under the forwarding terms. Any other organisation MAY operate one; holders choose whose terms they accept by the terms URL.