Developers
Sidekick Pro is an AI assistant for solo operators and small businesses. This page is the entry point for agents and integrators: the Sidekick Pro MCP server, OAuth 2.1 authorization, and every machine-readable file this site publishes.
Base URL: https://sidekickpro.com. Questions:
hello@sidekickpro.com.
Sidekick Pro speaks the Model Context Protocol. Point any MCP client at the endpoint below
and it will discover a single tool, messageSidekick, which takes a
natural-language message for the user's assistant and returns the assistant's reply.
| Endpoint | POST https://sidekickpro.com/mcp |
|---|---|
| Transport | Streamable HTTP |
| Tool | messageSidekick({ message: string }) |
| Auth | OAuth 2.1 bearer token, or a signed-in Sidekick Pro session cookie |
The assistant behind that tool has the user's email, calendar, tasks, documents, contacts, phone and SMS, memory, and connected apps, and an authorized connection can reach all of it. See Authorization before you store a token.
Authorization is OAuth 2.1: authorization code flow with PKCE (S256) and RFC 7591 dynamic client registration, so a client can register itself with no manual onboarding. Discovery starts at /.well-known/oauth-protected-resource.
Authorization is all-or-nothing today. The server issues one scope,
mcp:tools, and there is no narrower one to request. A token for this server
reaches the assistant with every tool enabled, so treat it as equivalent to the user's own
access and store it accordingly.
| Scope | Grants | Withholds |
|---|---|---|
mcp:tools | Full assistant access. Sidekick may use every tool it has and act on the user's behalf: email, calendar, phone, SMS, documents, browser control, and connected apps. | Nothing beyond what the signed-in user can already do themselves. |
The user sees which client is asking, and what it will be able to do, on a consent screen before approving. The token response states the scope granted.
# Discover the authorization server
curl -s https://sidekickpro.com/.well-known/oauth-protected-resource
# Register a client
curl -s -X POST https://sidekickpro.com/mcp/oauth/register \
-H 'Content-Type: application/json' \
-d '{"client_name":"My Agent","redirect_uris":["https://example.com/callback"]}'
# Send the user to authorize
https://sidekickpro.com/mcp/oauth/authorize?response_type=code&client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256Every page on this site has a Markdown twin, generated from the page itself at build time so it never drifts. Two ways to get it:
# Content negotiation on the same URL
curl -sH 'Accept: text/markdown' https://sidekickpro.com/teams
# Or the explicit .md twin
curl -s https://sidekickpro.com/teams.md
Negotiated responses carry Vary: Accept, Accept-Encoding, so a cache never hands
the HTML variant to a client that asked for Markdown. HTML responses also advertise the twin
with a Link: </teams.md>; rel="alternate"; type="text/markdown" header. A
request that accepts neither type gets 406 rather than a silent fallback.
A path that does not exist returns a real HTTP 404, never a 200 with an app
shell. Clients that ask for Markdown, and clients that name no media type at all, get a short
Markdown body that links this page, llms.txt, and the sitemap, so an agent can
recover from a wrong guess in one more request.
curl -s -o /dev/null -w '%{http_code}\n' https://sidekickpro.com/no-such-page
# 404
curl -sH 'Accept: text/markdown' https://sidekickpro.com/no-such-pageopenapi.json OpenAPI 3.1 description of the Sidekick Pro API, including the OAuth security scheme and what its scope permits. .well-known/oauth-protected-resource RFC 9728 protected resource metadata. Start MCP discovery here. .well-known/oauth-authorization-server RFC 8414 authorization server metadata: endpoints, grants, and scopes_supported. llms.txt Curated index of every page, linking the Markdown twin of each. llms-full.txt The whole site as one Markdown document. sitemap-index.xml XML sitemap for crawlers. robots.txt Crawl policy. Everything public is allowed.