The agent door · ask free · actions opt-in
Some of your visitors aren't people anymore.
AI agents already browse websites on their users' behalf — through the human door, with browser automation. The agent door is a structured entrance instead: visiting agents ask questions over MCP, answers come from your platform's own knowledge with citations, and you see every visit in your dashboard. Asking is free and anonymous, capped per door. Actions are the next rung, live today — each one opt-in by the owner, run through quote → confirm exactly once, with agent keys minted on the platform itself and, where the owner requires it, a human's one-tap approval on their phone.
Agents are already visiting. Give them a lane you can see.
The biggest open-source personal agents already browse like humans: Nous Research's Hermes ships browser automation with CAPTCHA solving and residential proxies, and OpenClaw's community shopping skills spend with the user's stored credentials. No purchase guardrails. Amazon's Buy for Me visits merchant sites uninvited; opting out means emailing Amazon. None of them asks your permission, and none of them shows you what happened.
The door is the sanctioned lane: rate-capped, fully observed, every visit receipted as a transcript you can read. Agents get grounded answers instead of scraping — the door cites your own knowledge and refuses to guess. Past questions, the ladder is live too: actions your code declares, opened per action by you in the dashboard, executed through quote → confirm exactly once, with agent keys your own users mint on your own platform. Payments are live too: you price an action in code, the quote pins that price, and the charge runs on your own Stripe — Bubblio never holds funds.
And since actions can matter, each one carries a consent control you own: run silently, ride a standing “don’t ask again under these caps” mandate, or ask the human every time. Asking means a phone page — the agent relays a link, your customer checks a binding code and approves with Face ID, and one approval covers exactly one quoted action. Keyed actions can even start keyless: publish your login page once and the same phone tap signs the human in on your site, mints the agent’s key server-side, and hands it to the agent — nobody ever copies a key. Humans see and revoke everything at bubblio.dev/approvals, with or without their agent’s cooperation.
Doors speak MCP. Knock instead of scraping.
Every Bubblio door is a stateless MCP endpoint (Streamable HTTP, JSON responses) that starts with two tools: about — what this platform is and what visiting agents may do here — and ask — a question answered from the platform's own knowledge, with cited sources. Doors whose owners have opened actions expose three more: list_actions, quote, and confirm — a quote pins the exact call, a confirm executes it exactly once, and a duplicate confirm replays the original receipt instead of running twice. Each door also serves a JSON manifest and an llms.txt, and the directory below lists every open door. Since March 2026, when OpenAI shut down ChatGPT's centralized Instant Checkout, the industry has converged on agents transacting at the merchant's own endpoint — a door is that endpoint, with the owner deciding each rung.
One connector, every door. The hub speaks the same tools plus find, with the door chosen by argument (door: "stylica") — its six-tool surface never changes as doors come and go. Register it once as a claude.ai custom connector (Settings → Connectors → Add custom connector → https://andresomar95--bubblio-api-serve.modal.run/agent/hub/mcp) and every platform in the directory is reachable, including ones that open their doors later. Nothing is pooled: a door reached through the hub keeps its own keys, approvals, prices, and rate caps — the hub is routing, never a bypass. Platforms that want their own listing still hand out their per-door URL; both stay first-class.
Point any MCP client at the hub — or at a single door. With Claude Code it's one line:
No MCP client at all? A door is plain HTTP — stateless JSON, one JSON-RPC message per POST, no session handshake, no connector registration. Any web-capable agent can knock mid-task:
Asks are rate-capped per door and anonymous: no auth, no account linkage. Actions are different — each one exists only where the owner opened it, and many require an agent key (bak_…) that your user mints in their own account on that platform, then hands to you as agent_key on quote. If a door has no open actions, asking it to buy something gets a plain answer saying so.
Some actions add the human to the loop: quote answers needs_approval with an approval link and a relay_script — send that text to your user verbatim, then keep calling confirm with the same quote_id (wait_seconds ≤ 25): it long-polls as the approval, answers awaiting_human until they decide on their phone, and still executes exactly once — one approval covers exactly one quoted action, and polling never consumes the quote. A keyed action hit without a key can end the same way with a key of your own: where the platform has published its login page, the human’s tap signs them in there and your poll delivers a fresh bak_… exactly once (store_this_key: true — keep it). Declines are final; don’t re-ask.
Doors open right now
Bubblio is in private beta. The developer quickstart — actions in code, keys, the decision ceremony — is at /docs/quickstart. The story of why doors exist is on the blog: your next visitor won't have a mouse.
Actions ship hidden and open only when the owner decides — per action, from the dashboard; a deploy can never open one. Every action runs through quote → confirm and executes exactly once. Paid actions charge on the platform's own Stripe at the quoted price: Bubblio never holds funds. Doors never guess: answers come from the platform's own knowledge with cited sources, and the door says so when it doesn't know.