Agents

Why connect through StarReview

An agent can write a reply, but it can never post directly as the business. StarReview holds the approved Google Business Profile access and applies your existing approval and automatic-publishing settings. TripAdvisor, Booking.com, Expedia and HolidayCheck have no reply API, so the owner posts there through a supplied link. Connect through StarReview and your agent gets:

• Posting to Google Business Profile from StarReview's own infrastructure, under the business's identity
• For TripAdvisor, Booking.com, Expedia and HolidayCheck (which have no reply API), a ready-to-post reply plus a direct link the owner posts through
• The business's own voice, learned from its past replies and owner edits
• Agent-written, edited, or safety-held replies always remain pending for human approval
• A sentiment check on every draft, so nothing goes out that should not
• A full audit trail of every action the agent takes

Guides for your agent

Step-by-step guides per agent, from connecting to the first approval:

Prefer the command line? The StarReview CLI (@starreview/cli) prints JSON on stdout and is built for agents and scripts.

Try it without an account

Three tools need no credential at all. Point any MCP client at the endpoint with no Authorization header and you get:

• get_service_info: what StarReview does, what it costs, and how to authenticate
• search_business: find a business on Google Maps by name and city
• check_response_rate: what share of a business's recent Google reviews got an owner reply, benchmarked against two nearby competitors

Read-only, and rate limited per IP. Authenticate and you get the seven business tools instead; the two sets are separate, so an authenticated client stops seeing these.

Endpoint

https://mcp.starreview.ch/

Streamable HTTP MCP. Connect via OAuth (recommended, see below), or authenticate with an account-wide owner bearer key in the Authorization: Bearer header. Send Accept: application/json, text/event-stream on every request. The same server is also reachable at https://api.starreview.ch/api/agent/mcp. See the current Agent and MCP privacy notice for how agent data is handled.

OAuth discovery follows RFC 9728: fetch https://mcp.starreview.ch/.well-known/oauth-protected-resource to find the authorization server, then register dynamically and run the authorization code flow with PKCE. A request without a credential answers 401 with a WWW-Authenticate header pointing at the same document, so a client that speaks the spec can find its own way in.

Tools

• list_locations: the locations connected to the business you are acting for
• list_unanswered_reviews: Google, TripAdvisor, Booking.com, Expedia and HolidayCheck reviews still waiting for a reply, each tagged with its platform
• get_review_stats: read-only review KPIs: average rating, response rate, backlog and a per-platform breakdown
• get_review_context: the full review plus any existing drafts
• draft_reply: generate a reply in the business's voice
• submit_reply_for_approval: submit a StarReview variant for approval and automatic-publishing policy evaluation, with optional edited text and preferred post time. Edited text remains pending; platforms without a reply API return a link for manual posting
• submit_own_reply: put your agent's own reply text into the owner's approval queue, with no StarReview draft; always human-approved, never auto-scheduled

The flow

1. Your agent lists unanswered reviews and reads their context.
2. It submits a reply, using StarReview's draft or its own text, with an optional preferred post time.
3. StarReview evaluates the reply against your consent, settings, and safety gates. Agent-written, edited, or safety-held replies remain pending for approval.
4. An eligible, unedited StarReview draft may be scheduled automatically. Platforms without a reply API return a link for the owner to post manually.

Connect via OAuth (recommended)

From Claude or any MCP client that supports OAuth, add StarReview as a connector and sign in with your StarReview account. You approve once on a consent screen, and the agent can then draft and submit replies for the businesses you own. There is no token to copy or manage, and you can disconnect any time from your StarReview settings. The connection is scoped to your own businesses: an agent can never touch a business you do not own, and it still never posts a reply itself.

If you own more than one business, an OAuth connection identifies you, not a single business, so the agent has to say which one it means. Call a tool without businessId and you get a picker back instead of the work being done:

{
  "businesses": [
    { "businessId": "...", "name": "Restaurant Adler" },
    { "businessId": "...", "name": "Cafe Baur" }
  ],
  "hint": "You manage multiple businesses. Call again with businessId set to one of these."
}

This is a successful result, not an error, so check for it before treating a response as the answer. Call again with businessId set. Tools that take a reviewId never return a picker: the review already determines the business. Account-wide owner keys follow the same business-selection rules as OAuth. Only an explicitly business-scoped legacy or admin credential pins one business and therefore has no picker.

Connect from your code

For programmatic access, or a client without OAuth, use an account-wide owner bearer key instead. StarReview is a standard streamable HTTP MCP server. From the Claude API, add it to mcp_servers and pass the owner key as authorization_token:

{
  "model": "claude-sonnet-5",
  "max_tokens": 1024,
  "messages": [
    { "role": "user", "content": "Draft replies for my unanswered reviews." }
  ],
  "mcp_servers": [
    {
      "type": "url",
      "url": "https://mcp.starreview.ch/",
      "name": "starreview",
      "authorization_token": "sragt_your_business_token"
    }
  ],
  "tools": [
    { "type": "mcp_toolset", "mcp_server_name": "starreview" }
  ]
}

The MCP connector is in beta, so send the current MCP connector beta header (see Anthropic's MCP connector docs). Other MCP clients connect the same way: point them at the endpoint and set the Authorization: Bearer header.

Walkthrough

A typical run. Every tool call returns JSON; the shapes below are representative.

1. List what needs a reply. Call list_unanswered_reviews:

[
  {
    "reviewId": "a1b2c3d4-...",
    "starRating": 5,
    "text": "Super Service, sehr freundlich!",
    "reviewerName": "M. Keller",
    "reviewDate": "2026-07-01",
    "sentiment": "positive",
    "provider": "google",
    "hasDraft": false
  }
]

2a. Let StarReview draft it in the business's voice. Call draft_reply with the reviewId:

{
  "variants": [
    { "variant": 1, "text": "Vielen Dank fuer die netten Worte, Herr Keller ...", "riskFlags": [] }
  ],
  "language": "de",
  "sentiment": { "bucket": "positive", "confidence": 0.95 },
  "approvalReason": "agent_draft",
  "wouldAutoPublish": true
}

Then commit a variant with submit_reply_for_approval ({ "reviewId": "...", "variant": 1 }), optionally overriding its text.

2b. Or bring your own text. Skip drafting and call submit_own_reply:

// request
{ "reviewId": "a1b2c3d4-...", "finalText": "Danke vielmals, Herr Keller!" }

// response
{ "submitted": true, "autoScheduled": false }

autoScheduled is always false for your own text: it always waits for a human.

3. StarReview applies your rules. Agent-written, edited, or safety-held replies remain in the approval queue. An eligible, unedited StarReview draft may be scheduled under your current consent and automatic-publishing settings. On platforms without a reply API, the response returns awaitingManualPost: true and a platformListingUrl; the owner posts there manually.

Plans

If a business already has a StarReview plan, its agent works within that plan. If you run an agency operating many client businesses, or you are building a product on top of StarReview, get in touch and we will set up the right plan for your volume.

Getting a key

Connecting via OAuth needs no key: you sign in with your StarReview account and approve. Account-wide owner bearer keys are the self-serve alternative for programmatic use and cover the businesses owned by that account. Legacy or admin-issued credentials may be explicitly limited to one business. If you run an agency or an agent product and want to connect client businesses, get in touch and we will set you up.

FAQ