Röstwerk AI Support Agent

Problem

Support automation rarely fails at the language model. It fails at trust: a bot that sounds plausible while inventing order statuses is worthless in production. So the test is narrow. Can you verify, for every statement the agent makes, where it came from?

The second problem is economic. Support has to answer in seconds. And it has to cost cents per ticket, or it will not scale.

Architecture

The core is a hard separation. The agent loop is a plain TypeScript library that knows nothing about frameworks; transport, model, and tools only meet at the edges: one SSE route for transport, gpt-5-nano over the Responses API as the model, four read-only shop tools.

Every boundary is Zod-validated: tool arguments before execution, tool results before they re-enter the model, the final reply before delivery. Whatever a schema rejects never reaches a tool or the model.

Without OPENAI_API_KEY a deterministic scripted provider runs the same loop: same trace format, same schemas. The demo keeps working offline, in tests, and past the daily budget. A visitor never sees an error page.

Guardrails & Evals

Inputs are hard-limited, in length and in format. The system prompt holds the agent to four rules: facts come exclusively from the tools, the reply follows the site's language, personal data stays out, and nothing is stored. A conversation exists only for the one answer.

Eval cases ship as unit tests: an order that is found, an order that is not (admitted honestly), a sold-out product, an off-topic pivot, prompt injection (“ignore your instructions”: the agent stays on topic), and a reply that breaks the schema. That last case ends loudly, never in a confident wrong answer.

After three tool rounds the loop stops hard. That prevents runaway chains and caps the price per run.

Cost & latency (measured)

gpt-5-nano is the cheapest GPT with reliable function calling. It costs $0.05 per million input and $0.40 per million output tokens (standard tier, September 2026).

A typical run with one tool call uses about 1,300 input and 270 output tokens: roughly $0.0002 at 5 to 8 seconds (reasoning effort “low”). The daily budget is hard-capped. Past the cap a scripted mode takes over, at zero marginal cost.

GDPR & EU AI Act

The endpoint stores nothing. There are no cookies, no accounts, and no conversation logs; model calls run with store:false. No personal-data scope ever arises, because the tools contain only demo data (data minimisation, Art. 5 GDPR).

Since 2 August 2026 the EU AI Act applies in full. A support agent of this kind is minimal-risk. It uses no biometrics, makes no decisions about people, and is labelled as AI. This classification is documented in the privacy policy. That is what separates an auditable support agent from “some chatbot.”

MCP: the site as a tool

The same four tools also run as a public MCP server (spec 2026-07-28, Streamable HTTP, stateless, read-only): https://dimitripisarev.com/api/mcp

Add the URL to Claude as a custom connector and ask about order 1042; the server answers with structured content. The endpoint skips OAuth, sessions, and any state between requests. Privacy lives in the architecture here, not in boilerplate.