nobrokerhood-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@nobrokerhood-mcppre-approve Zepto delivery for apartment 101"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
nobrokerhood-mcp
A CLI and MCP server for pre-approving deliveries and visitors at your gate via the NoBrokerHood resident app — so you (or an LLM on your behalf) can say "let the Zepto guy in" instead of opening the app.
This is an unofficial client. It is not affiliated with or endorsed by NoBrokerHood.
Install
pip install git+https://github.com/smtchahal/nobrokerhood-mcp.git(Not yet published to PyPI.)
Related MCP server: Kotak Neo Trading MCP
Authentication
There's no OAuth flow — the client authenticates the same way the mobile app does, with a captured session. Proxy the NoBrokerHood app once (e.g. with mitmproxy or Charles Proxy) and pull the following out of a request:
NBH_USER_ID,NBH_SOCIETY_ID,NBH_DEVICE_ID— from theuserId/societyId/deviceIdrequest headersNBH_REMEMBER_ME,NBH_JSESSIONID— from theremember-me/JSESSIONIDcookies
Copy .env.example to .env and fill these in (or export them directly — the client reads plain environment variables, nothing loads .env for you).
These sessions are long-lived but not eternal; if you start getting auth errors, recapture them.
CLI usage
nbh pre-approve zepto --apartment-id <id>
nbh pre-approve dominos --apartment-id <id> --hours 4
nbh pre-approve amazon --apartment-id <id> --out "25/04/2026 23:59" --vehicle TWO_WHEELER
nbh cancel <visit-id> --apartment-id <id>
nbh list --apartment-id <id>
nbh visits --apartment-id <id>
nbh user-infoRun nbh <command> --help for the full flag list. ~100 delivery brands (Zepto, Blinkit, Swiggy, Dominos, Amazon, couriers, home services, ...) have built-in default approval windows — see nobrokerhood.companies.KNOWN_COMPANIES. Unknown brands default to a 1-hour window.
MCP server
Registers six tools: pre_approve, cancel_visit, list_expected, list_visits, get_user_multiprofile_info, known_companies.
Add to your MCP client config (e.g. .mcp.json for Claude Code):
{
"mcpServers": {
"nobrokerhood": {
"command": "nobrokerhood-mcp",
"env": {
"NBH_USER_ID": "...",
"NBH_SOCIETY_ID": "...",
"NBH_DEVICE_ID": "...",
"NBH_REMEMBER_ME": "...",
"NBH_JSESSIONID": "..."
}
}
}
}This runs the server over stdio with no authorization layer — appropriate for local use, where the MCP client is the only thing that can spawn the process.
Self-hosting over HTTP
If you want to expose this server remotely (e.g. behind a tunnel, for use from claude.ai instead of a local client), nobrokerhood.server exposes a build_server() factory instead of a fixed server instance, so you can bring your own authorization:
from nobrokerhood.server import build_server
mcp = build_server(
host="0.0.0.0",
port=8000,
streamable_http_path="/mcp",
token_verifier=my_token_verifier, # implement mcp.server.auth.provider.TokenVerifier
auth=my_auth_settings, # mcp.server.auth.settings.AuthSettings
)
mcp.run(transport="streamable-http")This package intentionally does not ship an authorization implementation — how you authenticate callers to your server is a separate concern from how this client authenticates to NoBrokerHood.
Library usage
from nobrokerhood import NobrokerhoodClient
client = NobrokerhoodClient() # reads NBH_* env vars
client.pre_approve("Zepto", apartment_id="...")See nobrokerhood/client.py for the full API (pre_approve, cancel_visit, list_expected, list_visits, register_device, get_user_multiprofile_info, get_home_content).
Development
pip install -e ".[dev]"
pre-commit install
pytestLicense
MIT — see LICENSE.
Available Tools
4 toolscancel_visitA
Cancel a previously pre-approved visit by its visit ID.
Use this when the user wants to cancel a delivery approval they no longer need. The visit_id is at response["data"][0] from the pre_approve call.
Call get_user_multiprofile_info first to obtain the apartment_id if not already known; skip if the user explicitly provided it.
Args: visit_id: The visit ID string returned when the visit was created. apartment_id: The apartment ID the visit belongs to. Fetch from get_user_multiprofile_info → data.apartments.apartment.id. fields: Dot-notation paths to filter the response. Omit to return everything.
Returns the raw API response dict on success.
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | ||
| visit_id | Yes | ||
| apartment_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully convey behavioral traits. It describes the action and return value but omits side effects, permissions required, or failure modes (e.g., whether cancellation is reversible or allowed after certain states). This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose first, then usage guidance, then parameter explanations. It avoids redundancy and front-loads the action. Slightly verbose in parameter details but efficient overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema or annotations exist, so completeness relies on the description. It covers how to get parameters, what the tool does, and what it returns ('raw API response'). However, it lacks details on error handling, idempotency, or constraints (e.g., cancellation window). Adequate but not thorough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description explains each parameter's meaning: visit_id (from creation), apartment_id (from get_user_multiprofile_info), and fields (dot-notation filtering). It adds significant context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool cancels a pre-approved visit by visit ID, using a specific verb and resource. It distinguishes from sibling tools (list_expected, list_visits) which handle listing, not cancellation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use it (user wants to cancel a delivery approval) and provides step-by-step instructions for obtaining required IDs from get_user_multiprofile_info. It lacks explicit when-not-to-use or alternatives, but the guidance is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_user_multiprofile_infoA
Fetch the authenticated user's multiprofile information.
Use this when the user asks about their profile, apartments, family members, society details, or pass codes: "what apartments do I have?", "show my profile", "who are my family members?", "what's my pass code?", "which societies am I in?".
Also use this FIRST whenever another tool needs an apartment_id — unless the user explicitly provided the apartment_id, in which case use it directly. Call with fields=["data.apartments.apartment.id", "data.apartments.apartment.name", "data.apartments.apartment.displayName", "data.apartments.apartment.buildingName"] to identify the right apartment before proceeding. If exactly one apartment is returned, use its ID immediately without asking the user to confirm. If multiple apartments are returned, match the user's input against all of: name (full apartment name), displayName (short label), and buildingName (tower/block name) — the user may refer to any of these.
Args: fields: Dot-notation paths to include in the response. Always specify fields to avoid fetching the full profile (which includes family, notification settings, and other data rarely needed). Omit only if the user explicitly asks for their complete profile information. Examples: - ["data.apartments.apartment.id", "data.apartments.apartment.name", "data.apartments.apartment.displayName", "data.apartments.apartment.buildingName"] → compact apartment list for matching and obtaining an apartment_id - ["data.user.person.name", "data.user.person.phone"] → just the primary user's contact info - ["data.passCodes"] → just the pass codes map
Returns the raw API response dict containing:
user: primary user details (name, email, phone, photo)
family: list of family members registered under the account
apartments: all apartments the user has access to, each with apartment details, area/block info, society info, ownership type (OWNER/TENANT), and residency tag
passCodes: map of apartmentId → entry pass code
notifcationSettings: all notification toggle states
hasMultipleProfile: whether the user has profiles across multiple apartments
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses return structure (user, family, apartments, passCodes, notificationSettings, hasMultipleProfile) and explains that specifying fields avoids fetching full profile. No annotations provided, but description covers behavior well; could explicitly state read-only nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections: purpose, usage, args, returns. Slightly verbose due to repeated examples, but front-loaded and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With one parameter, no output schema, and no annotations, the description provides comprehensive context: parameter usage, return structure, and guidance for common scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description thoroughly explains the 'fields' parameter: dot-notation paths, examples, default behavior, and advice to always specify fields to limit response. Adds crucial meaning beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch the authenticated user's multiprofile information' and provides numerous specific use cases (e.g., 'what apartments do I have?', 'show my profile'). It distinguishes from sibling tools that handle visits.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance on when to use: user queries about profile, apartments, family, society, pass codes. Also instructs to use first when another tool needs an apartment_id, with detailed steps for apartment matching.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_expectedA
List pre-approved deliveries that are currently pending arrival.
These are the user's active pre-approvals at their apartment.
Use this when the user asks about pre-approved deliveries that haven't arrived yet: "what have I pre-approved?", "show my pending deliveries", "what deliveries am I expecting?", "did I approve anything?", "list my approvals". Do NOT use for historical/past gate activity — use list_visits for that.
Call get_user_multiprofile_info first to obtain the apartment_id if not already known; skip if the user explicitly provided it.
Args: apartment_id: The apartment ID to list visits for. Fetch from get_user_multiprofile_info → data.apartments.apartment.id. page: Page number, 1-indexed. Default 1. page_size: Number of results per page. Default 5. sort_order: "asc" (soonest first, default) or "desc" (latest first). fields: Dot-notation paths to filter the response. Omit to return everything.
Returns the raw API response dict containing a list of pre-approved visits awaiting arrival, each with a visit ID, company name, and time window.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| fields | No | ||
| page_size | No | ||
| sort_order | No | asc | |
| apartment_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full behavioral disclosure burden. It explains return format (raw API response with visit ID, company, time window) and mentions pagination/sorting defaults. Could explicitly state read-only nature, but implied as list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with front-loaded purpose, then usage guidelines, then parameter documentation in a clean Args block. Every sentence adds value, no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters and no output schema, the description covers purpose, usage, parameter semantics, return format, and prerequisite call. Sufficient for an agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% (no parameter descriptions in schema), but the description compensates with detailed explanations for each parameter: apartment_id source, page/page_size defaults, sort_order enum, fields dot-notation filtering.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists pre-approved deliveries pending arrival, with specific verb 'list' and resource 'expected deliveries'. It distinguishes from sibling tool 'list_visits' which is for historical gate activity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use (user query examples like 'what have I pre-approved?') and when-not-to-use (historical: use list_visits). Also specifies prerequisite to call get_user_multiprofile_info to obtain apartment_id.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_visitsA
List current, past (expired), and denied visits for an apartment.
Use this when the user asks about gate activity (current, historical, or denied): "who's at the gate?", "who came today?", "show past visitors", "any denied entries?", "who visited recently?", "what deliveries came in?", "what deliveries are coming today?". Do NOT use for pending pre-approvals that haven't arrived — use list_expected for that.
Returns all categories in one call. Each category is a separate list:
data.current: visitors presently at the gate (checked in, not yet out)
data.expired: completed past visits (checked in and checked out)
data.denied: entry attempts that were denied at the gate
data.pending: pre-approved visits not yet arrived (overlaps with list_expected)
Each visit entry includes: company, visitor name/phone, inTime, outTime,
gate name, approvedBy, approvalType, visitorType, and approval status.
Company is at the top-level company field and also at
visitorProfile.company.
Call get_user_multiprofile_info first to obtain the apartment_id if not already known. Skip if the user explicitly provided it.
Args: apartment_id: The apartment ID to list visits for. Fetch from get_user_multiprofile_info → data.apartments.apartment.id. page: Page number, 1-indexed. Default 1. Applies to all lists. page_size: Number of results per page. Default 10. fields: Dot-notation paths to filter the response. Strongly recommended — omitting returns all four categories with full visitor data, which is large. Use fields to fetch only what the query needs: ["data.current"] → who's at the gate right now ["data.expired"] → today's completed visits ["data.current", "data.expired"] → active + past visits ["data.expired.company", "data.expired.inTime"] → company + entry time ["data.currentTotal", "data.expiredTotal", "data.deniedTotal"] → counts only Omit only if the user explicitly wants everything.
Returns the raw API response dict.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| fields | No | ||
| page_size | No | ||
| apartment_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It details return categories, pagination behavior, and field usage. Does not explicitly state idempotency or safety, but as a list operation it is clearly non-destructive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with sections, but slightly verbose given the complexity. However, every sentence adds value and no redundancy. Minor trim potential.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but description fully explains return categories and content. Also addresses prerequisite (apartment_id retrieval). No missing information for a list tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description adds extensive meaning: explains apartment_id source, page/page_size defaults, and fields parameter with concrete examples and recommendations. This far exceeds schema information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists current, past, and denied visits for an apartment. It distinguishes from the sibling tool list_expected by explicitly stating what not to use it for.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use examples (e.g., 'who's at the gate?') and when-not-to-use (pending pre-approvals, use list_expected). Also instructs to call get_user_multiprofile_info first to obtain apartment_id.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
4 tool updates
v0.1.0- First observed
cancel_visit - First observed
get_user_multiprofile_info - First observed
list_expected - First observed
list_visits
TDQS
Each tool has a distinct purpose: cancel a visit, list pending pre-approvals, list all visits, and fetch user profile. Overlap between list_expected and list_visits is explicitly addressed in the descriptions, so no ambiguity.
All tool names follow a consistent verb_noun pattern in snake_case: cancel_visit, list_expected, list_visits, get_user_multiprofile_info. The naming is uniform and predictable.
With 4 tools, the server is scoped appropriately for managing pre-approved deliveries and apartment visits. Each tool serves a necessary function without unnecessary bloat.
The tool set covers core operations: fetch profile, list pending, list all visits, and cancel. Minor gaps like a single-visit detail tool or search functionality are acceptable for the focused domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Human-in-the-loop API for AI agents. CAPTCHA, OTP, KYC, and approvals by real humans.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceHuman-in-the-Loop authorization gateway for AI Agents. Securely pause MCP workflows and route high-risk actions to human approvers via Slack or Email.851MIT
- FlicenseNot gradedqualityBmaintenanceEnables automated trading on Kotak Neo from AI environments with secure credential vault, TOTP generation, and smart order commands.-
- AlicenseNot gradedqualityBmaintenanceEnables AI assistants to operate property management systems via natural language, covering repair orders, owner info, payments, notices, and inspections. Features a full agentic workflow with human-in-the-loop and observability.MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI apps to securely connect to your Chirp home automation, letting you query sensors, control devices, manage automations, view alerts, and more through natural language.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/smtchahal/nobrokerhood-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server