The problem
Agents become useful when they can act in the real world: send email, take a phone number, pay, browse, and pull data. Every one of those abilities sits behind a different vendor, with its own API, auth, and price.
Wiring each vendor into each agent does not scale. Handing agents raw credentials and an open wallet is worse. The platform needed one layer that any agent can plug into, with spending and secrets under the owner's control.
Architecture
Agents connect over MCP, or over a REST API built from the same tool definitions. A tool router sits behind one catalog of vendor-neutral tool cards, and a ledger meters every paid call.
Key decisions
A stateless, tools-only MCP server
The MCP endpoint keeps no session state, so it scales like any HTTP service. Agents follow three steps: find a tool, read its schema, then run it. The REST API runs the same server underneath, so every tool has one definition and one charge.
One tool card, many vendors
A router merges offers from several vendors into one card that names no vendor. It picks the vendor and the price at call time. When one source cannot answer, it fails over to another, within a limit the owner sets.
Hold, then settle
Every paid call places a hold before the work and settles after it. The debit and its ledger row commit in one transaction, and amounts are stored as integer micro-dollars, so rounding never drifts.
Reading is free, writing needs the owner
Read tools run on their own. Write tools need the owner's approval. Steps that only a person should take, such as passwords, one-time codes, and payments, are handed back to the person.
Credentials never reach the agent
Credentials are encrypted at rest and injected at the last hop. Public apps connect with OAuth 2.1 and PKCE, agent runtimes pair through an owner-approved device code, and connect links work once and store only a hash. Requests for agents a caller cannot see return 404, not 403, so nobody can probe which agents exist.
A modular monolith with rules CI can check
Each feature exposes a narrow public contract, and CI fails the build on a dependency cycle or a reach into another feature's internals. The codebase can grow without turning into one tangle.
Results
- Any MCP-capable agent gains hundreds of real-world capabilities with one connection.
- Vendors can change behind a tool card without any agent noticing.
- Every cent is reserved before work and recorded with its ledger row.
- Owners keep control: no raw credentials, no unapproved writes, and spending limits per agent.
Tradeoffs
A neutral tool card hides vendor differences that a power user might want to choose. Holds lock funds for the length of a call, so long-running tools need a careful release path. A stateless server pages the catalog instead of streaming it, which costs an extra call or two per discovery.