The agent-callable layer for SMB transactions.
Agent Broker is the MCP server that lets autonomous AI agents (Claude, Cursor, Continue, any x402-aware client) actually do business with the long tail of small and mid-sized businesses worldwide — finding them, verifying them, booking appointments, sending messages, escalating to a human when stuck — with full TCPA / GDPR / CASL / PDPL compliance enforced at runtime by a non-bypassable gate.
Example: an agent gets a real consumer request —
"Book me a haircut at https://cal.com/jane-salon next Tuesday at 3pm"
Or an SMB asks its agent to text its opted-in customers about a sale. Or a
customer texts the salon "STOP" — our handle_inbound
classifies the opt-out and records it in the consent store automatically.
The compliance gate decides what's allowed, not the marketing copy.
Five message types, four channels, 22 jurisdictions.
What we facilitate
Consumer-initiated bookings. SMB-initiated messages to opted-in customers
(marketing, reminders, transactional). Voice calls with two-party recording
consent. Cold-start discovery via import_booking_url.
Inbound classification + automatic STOP / opt-out handling.
What the gate rejects
Marketing to recipients without a verified
consent_record_id. Bulk / list-based / drip campaigns.
Cold outreach to non-opted-in numbers. A/B test sends. Spam by any definition.
The gate runs synchronously before every send and returns a structured
compliance_violation receipt on rejection.
How enforcement works
/compliance/check runs before every outbound channel call. TCPA, GDPR, CASL, PDPL rules across 22 jurisdictions, including GCC (UAE, SA, OM, QA, KW, BH). A request that violates returns a structured receipt and never reaches a carrier.
Live activity
Public counters from this service. Update every 8 seconds. Numbers reset on each deploy.
Connect in one line, in any agent ecosystem.
We expose the same 12 tools through every protocol agents speak today.
MCP — Claude Desktop / Cursor / Continue
{
"mcpServers": {
"agent-broker": {
"url": "https://smb-broker.onrender.com/mcp",
"headers": {
"X-Agent-Identity": "$TOKEN"
}
}
}
}
OpenAI function calling
tools = httpx.get(
"https://smb-broker.onrender.com"
"/.well-known/openai-tools.json"
).json()["tools"]
Anthropic tool_use
tools = httpx.get(
"https://smb-broker.onrender.com"
"/.well-known/anthropic-tools.json"
).json()["tools"]
12 operations. One contract. Worldwide.
Same OutcomeReceipt schema for every operation. Same compliance gate. Same idempotency contract. No surprises.
find_business
Search verified SMBs by vertical + location + capability. ~$0.01
verify_business
Confirm an SMB's capabilities before committing. ~$0.02
send_message
Consumer-initiated transactional message (SMS / email / voice premium). ~$0.05 base
capture_lead
Structured intake when a consumer asks to be contacted by an SMB. ~$0.05
schedule_appointment
Direct API or voice fallback. $0.25 attempt + $0.75 on confirmed booking
send_transactional_confirmation
Booking / receipt / reminder — reliable delivery, OTP-grade. ~$0.03
handle_inbound
Classify and route inbound messages an SMB received. ~$0.08
escalate_to_human
Hand a stuck operation to a human operator. ~$0.50
get_status / get_outcome
Async polling and final result retrieval. ~$0.001
preview_cost
±5% accurate cost estimate before committing. Free
self_test
Live capability probe / health check. Free
import_booking_url
Turn any supported booking URL into a callable SMB. ~$0.005
What's actually here — verifiable, not vibes.
Every number on this row maps to something you can confirm with one
curl. Nothing simulated, nothing aspirational —
just what the live service does today.
Verify each: /.well-known/mcp.json for tools, /supply/platforms for the 12 booking integrations, /compliance/jurisdictions for the 22 rule sets, /manifest for the canonical contract, /health for live status.
Built right.
7 agent protocols
MCP, OpenAI plugin, OpenAI tools, Anthropic tools, A2A, llms.txt, OpenAPI.
Non-bypassable gate
Pre-check is the only path to outbound. PII stored as SHA-256 hash only.
Fallback chain
direct_api → voice_ai → sms → email → web_form. Circuit breakers per channel.
24h TTL
Scoped per (agent_id, operation, key). Safe to retry.
Webhook callbacks
HMAC-SHA256 signed. Up to 24h retry with exponential backoff.
Jurisdiction-detected
22 countries with native rules. International conservative default for the rest.