Roast My Startup, By Phone

Give an OpenComputer Serverless Agent a public startup URL. It uses Context.dev to read the live landing page, writes a painfully specific but useful teardown, then—only after a separate approval turn—uses AgentPhone to call the consenting founder and deliver it.

I gave an agent my URL. It read my landing page and called me to explain why it was bad.

The example includes the OpenComputer agent plus a Next.js interface. The entire analysis and optional call request stay in one durable agent session.

Deploy your own Development project in OpenComputer

What it demonstrates

• live rendered page and brand evidence from Context.dev;
• destination-scoped, write-only provider credentials;
• reactive tool exposure: draft first, call only after a new approval turn;
• a call tool exposed only on an exact standalone approval turn, with the tool parsing the E.164 destination from that approval;
• an installer-owned E.164 allowlist enforced inside the call tool; and
• a reusable oc-template.toml for the OpenComputer template flow.

The agent never discovers phone numbers and never calls a number scraped from a website. Use only a number you own or whose owner has explicitly agreed to the call.

Prerequisites

• Node.js 22 or newer
• an OpenComputer account
• a Context.dev API key
• an AgentPhone API key
• an AgentPhone agent with an attached outbound-capable phone number

Context.dev documents its API setup at https://docs.context.dev/quickstart. AgentPhone documents agent and outbound-call setup at https://docs.agentphone.ai/documentation/guides/agents and https://docs.agentphone.ai/documentation/guides/calls.

Configure Development

Install packages, authenticate, and link or create an OpenComputer project:

npm install
npm run opencomputer -- login
npm run opencomputer -- link

If your installed CLI does not expose the opencomputer script, use npx --package @opencomputer/cli opencomputer for the commands below.

Store provider API keys as managed secrets:

npx --package @opencomputer/cli opencomputer secrets set \
  CONTEXT_DEV_API_KEY --environment development --agent current

npx --package @opencomputer/cli opencomputer secrets set \
  AGENTPHONE_API_KEY --environment development --agent current

Set the non-secret AgentPhone agent ID and the one consenting number this deployment may call:

printf '%s\n' 'agt_replace_me' | \
  npx --package @opencomputer/cli opencomputer env set \
  AGENTPHONE_AGENT_ID --environment development --agent current

printf '%s\n' '+14155550123' | \
  npx --package @opencomputer/cli opencomputer env set \
  AGENTPHONE_ALLOWED_PHONE_NUMBER --environment development --agent current

Start the Development deployment watcher:

npm run deploy -- --watch

Run the Next.js interface

Copy .env.example to .env.local and configure:

• OPENCOMPUTER_API_KEY: a server-only OpenComputer credential;
• OPENCOMPUTER_AGENT: the deployed Development agent alias, normally startup-roast@development;
• ROAST_SESSION_SIGNING_SECRET: at least 32 random characters used to bind a completed draft to its optional phone number for 15 minutes; and
• ROAST_ALLOWED_PHONE_NUMBERS: comma-separated, team-controlled E.164 numbers that the demo may call; and
• NEXT_PUBLIC_DEPLOY_URL: the OpenComputer template installer opened by the footer's "Deploy your own" action. It defaults to this repository's public installer URL.

Then start the web interface without changing the agent deployment watcher:

npm run web

Open http://localhost:3000. The form always creates the roast first. If a phone number was supplied, a separate call button appears only after the draft returns and the ownership-and-consent checkbox is checked. The API key, signed session state, and provider credentials never enter the browser bundle.

The allowlist is intentionally restrictive. Before accepting arbitrary public numbers, replace it with real phone-ownership verification and add durable rate limiting. A checkbox by itself is not an anti-abuse control.

Run the two-turn demo

In a new playground session, use a team-owned public site:

Roast https://example.com. Be specific and prepare the phone script, but do not call.

Review the Context.dev evidence, three findings, rewrite, and concise 20–30 second phone script. No AgentPhone tool is available during this turn.

To call a consenting number, send a second turn in the same session containing only this exact shape:

CALL APPROVED: +14155550123

The static call tool exists in the compiled artifact but is exposed only after agent code parses the exact approval turn. It requires that complete approval turn verbatim, independently parses the E.164 destination, and requires it to equal AGENTPHONE_ALLOWED_PHONE_NUMBER before calling. The tool returns the AgentPhone call ID and status without echoing the number.

Verify without provider credentials

npm test
npm run typecheck
npm run template:build

Unit tests cover the approval phrase, E.164 enforcement, URL safety checks, evidence caps, and call-payload pinning. The template build requires a CLI with the Serverless Agent template command.

Safety boundary

• Interactive user turns only; schedules, webhooks, channels, subagents, and system inputs cannot analyze or call.
• A draft turn cannot access AgentPhone.
• Approval must be a separate turn exactly matching CALL APPROVED: <E.164>.
• The approved destination must equal the installer-configured AGENTPHONE_ALLOWED_PHONE_NUMBER.
• Website content is evidence, not instructions.
• The roast uses provocative, motivating tough love while targeting page copy and positioning—never people or protected traits.
• The agent must not invent business performance or private facts.
• There is no retry loop, bulk calling, SMS, number discovery, or autonomous outreach in this template.
• The included web demo calls only numbers in the server-side allowlist. Its signed, phone-bound call token is short-lived and reused submissions share an idempotency key.

Provider boundaries

Provider	Allowed operation	Credential
Context.dev	GET /v1/web/scrape/markdown, POST /v1/brand/retrieve	CONTEXT_DEV_API_KEY bearer token
AgentPhone	POST /v1/calls	AGENTPHONE_API_KEY bearer token

OpenComputer injects each write-only secret only into its declared HTTPS connection. Neither key is included in the source bundle, prompt, tool result, or browser code.

Template status

This repository contains the template source and manifest, but it should not be presented as live-verified until a real Context.dev analysis and a consented AgentPhone call pass from a fresh install. Provider contracts were checked on 2026-09-01 and should be rechecked before publication.