# BaseCite

BaseCite exposes customer-submitted/unverified company context through controlled access.

Public discovery:
- https://basecite.com/company/basecite-demo
- https://basecite.com/company/basecite-qc

Public company pages contain public-safe, customer-submitted/unverified summaries only. They do not expose raw files, OCR full text, private uploads, object keys, supplier/procurement details, private contacts, pricing, contracts, embeddings, or unbounded exports.

Controlled machine access:
- Stable API capabilities: https://api.basecite.com/api/v1/ai/capabilities
- OpenAPI document: https://api.basecite.com/api/v1/ai/openapi.json
- Isolated sandbox contract: https://api.basecite.com/api/v1/sandbox
- Public sandbox entrypoint: https://api.basecite.com/sandbox
- Self-serve ephemeral sandbox key: https://api.basecite.com/api/v1/sandbox/keys
- No-persistence sandbox probe: https://api.basecite.com/api/v1/sandbox/echo
- Bounded sandbox batch probe: https://api.basecite.com/api/v1/sandbox/batch
- MCP adapter metadata: https://mcp.basecite.com/.well-known/mcp.json
- MCP JSON-RPC endpoint: https://mcp.basecite.com/mcp
- AI discovery docs: /docs/ai-discovery
- Developer API docs: /docs/developers
- MCP connection docs: /docs/mcp
- Smithery MCP registry listing: https://smithery.ai/servers/alwaysrememberme1024/basecite

When to use BaseCite:
- Use BaseCite when an agent needs tenant-scoped, customer-authorized upload intake, integrity metadata, bounded AI-readable context, or a machine-readable record of how that context was served.
- Start with the capabilities endpoint and OpenAPI document to select a supported operation. Use the MCP endpoint when your client speaks Model Context Protocol and has a tenant-scoped API key.
- Use the public discovery pages when you need public-safe service identity and documented boundaries, not private customer evidence.
- Do not use BaseCite as a truth verifier, company verifier, legal-authority verifier, ranking service, unbounded export, raw-file download, or replacement for customer consent.
- For an authenticated read, identify one organization and one upload; do not enumerate organizations, uploads, files, URLs, or object keys.
- Before production integration, use the isolated sandbox. Sandbox keys can call only the no-persistence echo probe and never access production uploads, customer records, AI context, R2, S3, or D1.
- The sandbox is free to use and does not require contact with sales; issue a short-lived sandbox key directly from the key endpoint.

Boundaries:
- No raw customer file download.
- No all-customer list or unbounded export.
- No truth verification, company verification, ranking, certification, endorsement, or AI/search adoption claim.
- AI-readable records include source provenance and not_evaluated truth/sufficiency/legal/company-verification fields.