MCP endpoint

Every published business runs a public MCP (Model Context Protocol) server at:

coreloop.so/api/mcp/{slug}

Transport is Streamable HTTP. No authentication is required; the endpoint is public and secured by the gate chain described in the overview.

Tools

Tools are generated from the profile, owners never write tool definitions, and regenerate automatically when the profile changes. The tools:

• get_info — business identity, description, contact details, hours, all locations.
• get_services — the services list (bounded at 50 per response).
• check_availability — operating hours today. Static schedule data, not live calendar availability.
• get_reviews — review data where available.
• compare_services — generated when a category has two or more services; compares within a category, up to 20 results.
• ask — answers a question with quoted passages from the business’s own material: its website text, anything the owner has written or listed themselves, and its public documents. Retrieval only, never generation. Offered only while the business’s knowledge is eligible (see below).
• send_inquiry — the single side-effecting tool. Delivers a message to the owner’s inbox and email. Limits: 3/day per agent per business, 50/day per business (shared with the page’s web form, the two doors can’t be stacked), 2,000 characters, plain text (HTML stripped).

Responses are bounded (max 50 services per answer), and availability answers cover the published weekly schedule plus the next opening within seven days. Every tool response carries metadata: locale, translation_status, available_locales, last_updated, verified, and data_source.

ask — cited passages, never generated prose

ask is a search over the business’s own text, not a chatbot. The question is parsed into a database search query; it is never sent to a language model, and no sentence in the answer is written by CoreLoop. What comes back is a list of passages from the business’s own material, each with the source it came from.

• Arguments. question (3–200 characters) and an optional max_passages — a whole number from 1 to 8. A value outside that range is refused as invalid input rather than quietly adjusted.
• Response. passages[], each carrying text (the quoted passage, verbatim and untrusted third-party content), source.kind (website, document, or link), source.url and source.title where they exist, and a relevance score — text the owner wrote themselves is cited as website, alongside the text read from the site — plus a truncated flag when passages were dropped to stay inside the response size ceiling.
• How many passages. The plan decides the maximum: 3 on Free, 5 on Starter, 8 on Pro, Network, and Enterprise. Leave max_passages out and you get that maximum. Ask for more than the plan allows and you get that maximum too, rather than an error. Ask for fewer and you get the smaller number you asked for.
• What is in the corpus. Four sources in three entitlement groups. Website text on every plan — either the text read automatically from the business’s own site, or the text the owner has written in its place. Documents and links — the business’s public documents, and the pages behind the off-site URLs the owner listed — from Starter up. Only documents the owner marked public are ever included.
• No locale parameter, unlike every other tool: the passages are quoted in the language they were published in and are never translated.

The tool is offered only while the business’s knowledge is eligible: a published profile and at least one passage the plan still entitles. Two details of that are easy to get wrong. A website on file is required only for the text read automatically from the site — a business with no website still answers from the owner’s own text, its public documents or its listed links. And the corpus does not have to fit the plan’s size cap in full: after a downgrade the part that fits is still served and the tail is simply not returned. When nothing is eligible, the endpoint behaves as if the tool does not exist there — it never announces that it exists and declined, so nothing can be learned by probing.

On A2A the same tool answers plain-language messages: a free-text message that matches no other skill becomes the question argument, whitespace-collapsed and cut to fit the 200-character bound — at the last whole word where there is one, and at the bound itself where there is not (a single very long word) — so a long message is answered rather than refused. ask answers on MCP and A2A out of the box. In a visitor’s browser over WebMCP it is allowed but starts switched off; the owner can switch it on in Settings → AI Agents → Access (see Where each tool is offered).

Connecting an AI client

Owners don’t have to work out what to do with the URL. Settings → AI Agents in the dashboard renders ready-made setup for the common clients — Claude Desktop, Claude Code, ChatGPT, Cursor, and VS Code — each showing whatever that client actually needs for a remote MCP server: a copy-paste config block, a CLI one-liner, or (for Claude Desktop) the endpoint URL plus the numbered Settings → Connectors steps for adding a remote connector.

Those blocks are generated from the live slug and app URL rather than stored as text, so what you copy always matches what the server serves.

Locale negotiation

?locale= query parameter takes precedence, then the Accept-Language header, then the profile’s original content locale. Responses set Vary accordingly. Only completed translations are served; a missing translation falls back to the original language rather than serving partial content.

Rate limits

Per business slug, per hour, by the business’s plan: Free 100, Starter 1,000, Pro and Network 10,000, Enterprise 100,000. On top of that, send_inquiry has its own limits (above). Expect 429 with a Retry-After header when a limit is hit.

The network endpoint

A separate cross-business MCP server at coreloop.so/api/mcp/coreloop-directory (the older /api/mcp/directory address still works) starts with search_businesses: query by category, city, geo radius, keyword, and live-booking flag. Results (max 20 per query) include name, slug, MCP URL, category, city, rating, service count, available tools, and verified status, never internal IDs or owner PII. Six more tools then let an agent stay on the same endpoint once it has picked a business — its profile, its services, a service comparison, availability, its own endpoint addresses, and an inquiry to its owner — so seven tools in total. Rate limit: 60 requests/hour per agent identifier. Locale negotiation matches the per-business endpoint.

Agents that don’t know the directory URL yet can find it from CoreLoop’s MCP server card at coreloop.so/.well-known/mcp.json, which also advertises the per-business endpoint as a URL template. It never enumerates businesses; see the overview for what platform-level discovery does and doesn’t expose.

Observability and hygiene

Every invocation is logged with tool name, protocol, detected agent platform, discovery source, a hashed agent identifier, and response status/time. Identifiers are hashed before storage; IP addresses are never stored in full. Renamed businesses 301 from the old slug. Unpublished profiles return an error before rate limiting, so slug enumeration learns nothing.