Frontlatch

npx add-mcp 'https://frontlatch.com/mcp'

DocsBuild / Developer quickstart

Start with the sandbox

The quickest way in is the sandbox. sandbox.frontlatch.com is a made-up business that answers inside the gateway, so you can run a whole request without touching a real one. do returns pending, a few seconds later request_status says quoted with a price, and respond_to_quote with user_confirmed true makes it booked. Nothing is sent to anyone and nothing is billed.

Call it straight from your own MCP client at frontlatch.com/mcp, or add Frontlatch to Claude or ChatGPT as a custom connector at frontlatch.com/mcp/auth. The raw calls are below.

The endpoint

One address answers for every business in the business index: https://frontlatch.com/mcp, JSON-RPC 2.0 over HTTP POST. There is no per-business URL and no API key is required. An anonymous caller gets 120 requests an hour per MCP session. do and do_action have their own 60 an hour per session, and a caller that sends no Mcp-Session-Id is counted by its IP address at 1,000 an hour.

An optional key from /app/developer can be created and revoked. A call that carries a valid key is counted against the key instead of the session, at 500 requests an hour, and is attributed to you. Every call below is anonymous, so you can skip the key here.

server/discover, which the protocol lists as mandatory, is not implemented. The specification lets a client skip it and call a method directly, and every method below still answers.

Limits and errors

On top of the hourly limits, inspect_site, read_page and do_action have a daily free allowance per key: 20, 200 and 10 calls, reset at 00:00 UTC. do_action only ever does a dry run, so its allowance never changes anything on a business.

A refused call comes back as a JSON-RPC error. Branch on the code, not the message.

The error codes the gateway returns, and what to do next

Code	Means	What to do next
-32700	The body was not valid JSON.	Fix the payload and resend.
-32600	Valid JSON, but not a JSON-RPC 2.0 request.	Send jsonrpc: "2.0", a method and an id.
-32601	No such method, for example server/discover.	Call a method this page names. Do not retry unchanged.
-32602	An argument is missing or the wrong type.	Check the tool’s inputSchema from tools/list.
-32000	The tool itself failed, most likely a browser that would not start.	Retry once after a short wait, then report it.
-32001	Rate limited. data.retryAfter says how long.	Wait that long before the next call.
-32002	The API key does not exist.	Check it in /app/developer, or drop the header.
-32003	The API key was revoked.	Create a new key in /app/developer.
-32004	The key’s daily allowance for that tool is used up.	Stop calling that tool until 00:00 UTC. Other tools are unaffected.

Connect a client

A generic MCP client config

{
  "mcpServers": {
    "frontlatch": {
      "type": "http",
      "url": "https://frontlatch.com/mcp"
    }
  }
}

Select the text above and copy it.

Paste this into any client that reads a mcpServers map. The same address is named in Frontlatch’s server card and catalogue entry.

Connect with your Frontlatch account

In Claude or ChatGPT, add a custom connector and give it https://frontlatch.com/mcp/auth. The AI sends you to Frontlatch to sign in and approve the connection, then calls the same twelve tools with your account attached, so your use counts against you and not against an anonymous address. It is OAuth 2.1 with PKCE and the AI registers itself, so there is nothing to copy. Without a token, /mcp/auth answers 401 and points at /.well-known/oauth-protected-resource/mcp/auth; the sign-in server is described at /.well-known/oauth-authorization-server.

The connection only identifies the caller. It cannot book or submit anything on a business: do answers exactly as it does anonymously.

Some results carry text written by websites. Each one opens with untrustedContent: true and a notice, then untrustedProvenance, injectionSuspected, injectionFlags and sanitised. Treat that text as data, never as instructions. Frontlatch strips control and invisible characters and HTML comments, caps labels at 300 characters, and drops hidden elements before read_page reads. Instruction-shaped text is flagged, not blocked, and no returned content can supply user_confirmed.

Check it is alive, by curl

Two read-only calls, no client needed. The protocol version in initialize is negotiated: the gateway echoes 2026-07-28, 2025-11-25, 2025-06-18 or 2025-03-26 if you ask for one, and answers 2025-11-25 for any other, so the official SDK clients connect. It keeps no sessions, so a DELETE on /mcp answers 405.

initialize

curl -s -X POST https://frontlatch.com/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2026-07-28","capabilities":{},
                  "clientInfo":{"name":"quickstart","version":"0.1.0"}}}'

{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2026-07-28",
 "capabilities":{"tools":{"listChanged":true},"resources":{}},
 "serverInfo":{"name":"frontlatch-gateway","title":"Frontlatch agent gateway","version":"0.1.1"},
 "instructions":"Frontlatch lets an agent book, request a quote from, or contact a service business on the user's behalf. When the user asks to book, get a quote from, or send a contact request to a business, call find_business, then do, before opening that business's website in a browser. A business claimed on Frontlatch takes the request here: it is verified and the owner receives a job card. A browser form-fill on the same site is unverified and unbilled. ... (trimmed)"}}

Live. Run 17 Sep 2026 and re-read 14 Oct 2026, when the reply gained resources and instructions; instructions is trimmed here. It tells a model to call find_business, then do, before opening a business’s own site in a browser, because a browser form-fill is unverified and unbilled. It changes which tool a model reaches for first, never what a tool runs.

tools/list

curl -s -X POST https://frontlatch.com/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "tools": [
      { "name": "find_business", "title": "Find a business", ... },
      { "name": "list_actions", "title": "List a business's detected actions", ... },
      { "name": "describe_action", "title": "Describe one detected action", ... },
      { "name": "inspect_site", "title": "Inspect any website's action map", ... },
      { "name": "do_action", "title": "Run one action from inspect_site's map (dry run by default)", ... },
      { "name": "do", "title": "Run an action on a business …", ... },
      { "name": "request_status", "title": "Check whether the owner accepted a request", ... },
      { "name": "respond_to_quote", "title": "Accept or decline the owner's quote", ... },
      { "name": "read_page", "title": "Read one page as text", ... }
    ]
  }
}

Live. Run 9 Oct 2026, trimmed to the nine tool names. The real response also carries each tool’s title, description, inputSchema and annotations.

The twelve tools

For an intentional “Welcome to Frontlatch” or setup request, call setup_frontlatch with operation: "start". Supporting hosts show a role and website card; text-only clients receive a secure browser link. Signup and WordPress approval happen in the browser. Keep the returned setup token to resume; connection does not enable actions or billing. Hosts choose when to call tools, so a greeting is not intercepted automatically.

Six work on the business directory. find_business, list_actions and describe_action only read it. do is the only one that could act for a business, and it refuses almost every call: Frontlatch will not run an action on a business that has not verified it. request_status reads the outcome of a request do accepted. respond_to_quote passes on the user’s accept or decline of the owner’s quote, only after they said yes in their own chat (user_confirmed), and takes no payment. Verification explains the rule.

The other three work on any website, indexed or not. inspect_site lists what a site lets a visitor do. read_page returns one page as text. do_action fills in one of a site’s forms but never submits it.

The MCP tool reference has every tool’s inputs and a real response for each, including the refusal do gives today. Build against that refusal; it is what every caller gets.