Reads every enquiry, checks the facts, drafts the reply. A human clicks send.
A Claude agent for a small service business. It triages emails and web-form enquiries, looks up the customer, prices, service area and free slots through a custom MCP server, drafts a grounded reply and waits for approval in Slack before it sends, books or writes anything.
Small service businesses lose hours a week reading enquiries, looking up customers and prices, and writing the same replies. Urgent jobs get buried in the inbox, and handing the job to a chatbot that might invent a price is not an option.
An n8n pipeline reads Gmail and a web form, skips duplicates, and has Claude Haiku classify each enquiry: category, urgency, emergency, prompt-injection attempt. Gas leaks and vulnerable customers without heating are always emergencies, by rule.
Four read-only tools written in TypeScript: find the customer (verified by email or phone, masked otherwise), the price list and policies, the service area, and free appointment slots from Google Calendar.
Claude Sonnet drafts the reply in the business’s tone using only what the tools returned. Every price in the draft is checked against the real price list, and anything that doesn’t match goes to a person.
A Slack card shows the summary, the draft and its checks, with Approve, Edit and Reject. Approving replies in the email thread, creates the customer and job records and holds the offered slots in the calendar.
Anyone can send an enquiry, confirm it by email, watch every step with its timing and AI cost, then approve, edit or reject the draft themselves. Demo data is deleted after 7 days.
40 labelled enquiries plus 15 held-out ones never used for tuning, each draft graded fact by fact by a separate Claude model that was itself tested. The first-run numbers are published, misses included.
Run through the real pipeline in test mode. The held-out set was written separately and never used for tuning, so its first run is the realistic estimate.
| Measure | Result |
|---|---|
| Prompt-injection attempts flagged, no harmful draft | 5 / 5 |
| Drafts containing a forbidden fact (invented price, another customer’s details) | 0 |
| Drafts with every required fact (main set, after fixes) | 97% |
| Drafts with every required fact (held-out, first run) | 85% |
| Category accuracy (main set after fixes / held-out first run) | 100% / 80% |
| Emergencies caught (held-out first run: 1 of 2, fixed and documented) | 7 / 7 |
| Average AI cost per enquiry | $0.033 |
The held-out set caught a missed emergency on its first run. The fix and the reasoning are in the published evaluation report.Read the full report
The MCP tools are read-only. Nothing is sent, booked or written until a person approves.
Enquiry text is treated as data. Attempts are flagged and shown to the approver; the agent has no tool that sends or deletes.
Separate database roles for the pipeline, the MCP server and the demo, each proven by script to reach only what it needs.
Caddy with automatic HTTPS and an HAProxy gate: a path allow-list, per-IP rate limits, signature-checked Slack webhooks.
Every step, tool call, decision, approver and token cost is logged, so any reply can be traced back to its sources.
Errors post to an alerts channel instead of failing silently; API calls retry with backoff, duplicates are never processed twice.
Tell me what it is. I’ll come back with whether AI is the right fix, what it would take, and what it would cost to run.
Replies within 24 hours · Free 30-minute discovery call
That’s enough for me to come back with an approach, a rough timeline and the questions that matter.