ChecklistSquad
Hands-free inspections, signed in as the tech
Field techs talk. The agent does the tapping. Built on the API and OAuth ChecklistSquad already had.
- Time to ship
- 3 weeks
- MCP tools generated
- 9
- Net-new endpoints
- 0
- Auth code added
- 0 lines
At a glance
What this team built
The bet
Field techs would finish inspections faster if they could talk to the app instead of tap through it.
The harness
Existing inspection API + existing OAuth, exposed as MCP tools and embedded directly in the product.
The result
A hands-free assistant that acts as the signed-in tech — same data, same permissions, no rebuild.
The harness
Primitives in use
MCP gives agents tools in your backend. Client Tools give agents tools in your UI. Generated Views replace chat walls. Traces make every step auditable.
Server Tools
What the agent can do in your backend.
9 tools auto-generated from OpenAPI
Every inspection endpoint became a typed MCP tool with no hand-rolling.
Client Tools
What the agent can do in your UI.
ui.openInspection · ui.attachPhoto
The agent navigates the user to specific items and attaches photos via typed UI capabilities.
Generated Views
Composed work surfaces — not chat walls.
Inline action plans
When the tech asks for a follow-up, the agent renders an approve/edit list — not a wall of chat.
Traces
Per-user, per-tool. Audit on by default.
Per-tech, per-tool
Every call is logged with user identity, scopes, args, and outcome. Audit on by default.
Demo flow
What it actually does in the product
Each step is a real exchange — user prompt, agent action, screenshot.
- 1
User
"Where was I on the fire extinguisher walk?"
Agent
Agent reads the open inspection state for the signed-in tech.
- 2
User
"The pressure gauge reads 120 PSI."
Agent
Agent writes the value to the matching checklist row and marks it complete.
- 3
User
"Add a follow-up for any failed safety items this week."
Agent
Agent searches, filters the UI, renders an action plan, asks to confirm, then creates the actions.
Architecture
How it fits together
"We didn't write a model layer. We exposed the API and the auth we already had — and the agent showed up where the work happens."
Stack
What's under the hood
- OpenAPI 3.1
- Node.js
- OAuth 2.0 (Auth0)
- MCP Stack Gateway
- MCP Stack Host
- Agent SDK (React)
Want a showcase like this?
Bring your OpenAPI spec — we'll help you ship your first endpoint and the agent that uses it.
Behind the scenes▾
The team initially tried a service-to-service shared secret. Fast to ship. Wrong for trust.
The moment a field tech said "delete the safety log for site 4" the team had a problem: the agent had god-mode credentials. There was no per-user authorization story. They reached for OAuth specifically so the agent could only do what the signed-in tech could do, no more.
MCP Stack's gateway handled the token exchange. The ChecklistSquad app received an access token, passed it on the MCP request, and the gateway propagated identity end to end. No new auth code on the ChecklistSquad side — they reused the IdP they already had.
That's the harness pattern: don't rebuild your app for AI; expose your app to it.