Small Business Intelligence by Brick & Mortar — how it works, what it can do, and what to check before approving it.
No authentication required — add it as a custom connector in Claude (or any MCP-compatible client) using the URL above. Nothing to sign in to, no API key to generate.
Try it once connected:
Each tool covers a distinct piece of small-business analysis. They're designed to be used
individually or chained — run a few, then hand the results to compose_report to
assemble one polished write-up.
| Tool | What it does |
|---|---|
business_teardown | Full structured teardown of one named business — presence, review signal, competitive position, pricing, visibility gaps, prioritized recommendations. Start here for a single-business question. |
competitor_landscape | Maps the true competitive set for a category + metro — who's a real competitor vs. an adjacent player, positioning, saturation. |
review_intelligence | Mines public reviews for complaint/compliment themes, sentiment trajectory over time, and buyer-relevant red flags. |
local_visibility_audit | Scored local-search presence checklist — map-pack factors, listing consistency, category selection, site fundamentals. |
pricing_benchmark | Defensible local pricing comparison within a category, including how to normalize non-identical service bundles. |
broker_diligence_prep | Pre-diligence framework for brokers/buyers — SDE framing, current-multiple research method, red-flag checklist, seller questions. |
market_opportunity_scan | Gap analysis for a category × metro — underserved demand, oversaturation, and genuine whitespace vs. structurally-empty ground. |
compose_report | Assembles the outputs of prior tool calls into one client-ready report, tone- and structure-matched to the audience (owner, broker, buyer, investor). |
This server ships analytical methodology, not data. Every tool call returns a structured research framework — a named analytical lens, an ordered set of concrete research steps, the exact shape the finished deliverable should take, a quality rubric, and honest caveats. Your AI assistant reads that framework and then does the actual work itself: it runs its own web search, follows the procedure, and writes the deliverable.
Practically: ask your AI to research a business, it calls one of these tools, the tool hands back the framework for that kind of analysis, and your AI executes it live. That's also why the analysis is always current — there's no cached dataset to go stale.
We log a one-way hashed representation of the caller's IP address, rotated every UTC day, paired with a per-day call count. That's it for anything identity-shaped — no request bodies, no tool arguments, no business names or search queries, no conversation content. Full detail in the privacy policy. This exists only to support a metered free-usage tier that is not currently active — every call is allowed today, unlimited.
Separately, we keep an aggregate, non-identifying count of calls per tool per day (e.g. "business_teardown: 340 calls on 2026-08-09"), used only to understand which tools are useful. It has no connection to the hashed-IP counter and carries no identity of any kind.
None. The server makes zero calls to external APIs, databases, or third-party services. All research a tool call triggers happens in the calling AI's own session, not on our infrastructure.
None required. Per the MCP specification, authorization is optional — a server that doesn't require it is compliant by not implementing the OAuth flow at all, rather than serving misleading auth challenges. The codebase is architected so OAuth 2.1 + PKCE can be added later without restructuring, if a future paid tier needs it.
All 8 tools are marked readOnlyHint: true in their MCP tool annotations and are
read-only in practice — none of them write, delete, or modify anything anywhere. A tool call
cannot take any action outside of returning a JSON framework object; every actual write action
(sending a search query, browsing the web) is performed by the calling AI using its own tools,
not by this server.
Streamable HTTP over HTTPS, served from Cloudflare Workers. Origin and Host headers are
validated on every request to the /mcp endpoint to guard against DNS-rebinding-
style attacks.
Built and operated by Brick & Mortar AI (brickandmortar.dev), Saint Paul, MN. This MCP server is a free, standalone product — it is not a funnel into a paid offering, and using it does not require any relationship with Brick & Mortar's other services.
Questions, issues, or approval-review requests: reach Brick & Mortar AI via brickandmortar.dev.