ClinicSoftware MCP turns your diary, client records, treatment history, stock and invoicing into tools an AI agent can actually call. Read-only by default. Drafts before sends. Every call on the tape.
Every clinic system on the market assumes a human at a keyboard: a form to fill, a tab to find, a status to toggle. An agent can read your screen. It can't operate your business. MCP is the difference between the two.
Pick a desk. Watch the same server serve a different job.
Claude, GPT, Cursor, your own orchestrator. The server exposes tools; it doesn't care which model calls them.
Typed inputs, typed outputs, human-readable descriptions. Agents discover what's possible instead of guessing.
OAuth per user. An agent can never read a room, a branch or a record its operator couldn't open themselves.
Connect in read-only and stay there for as long as you like. Write scopes are enabled per tool, per site.
Client-facing messages are composed as drafts and held at an approval gate. Your agent proposes; your team sends.
Caller, tool, arguments, result, timestamp. Exportable. Built for the moment someone asks what the AI did.
No middleware to maintain. The server sits in front of your existing application layer, so business rules, validation and permissions stay exactly where they are.
A person asks, or a schedule fires. The model turns intent into a tool selection.
"Book Maria in for her 3rd laser session, same slot as last time."
The server returns typed schemas, so the agent knows the exact shape of a valid call.
{
"tool": "clients.search",
"scope": "read",
"args": { "q": "Maria" }
}
Requests route through the application layer — never straight at the database.
POST /mcp/tools/invoke
{
"tool": "appointments.create",
"scope": "write:gated",
"args": { "client_id": 40812,
"service_id": 77,
"start": "2026-09-02T14:30Z" }
}
Structured result, written to the audit tape, ready for the next step in the chain.
{
"status": "created",
"appointment_id": 918244,
"audit_ref": "mcp_7c41e9"
}
Native tools for the modules your team lives in — and outbound connectors so an agent can finish the job outside the CRM.
Illustrative scenarios from the private beta — swap for real, attributed quotes before you publish.
“Our diary manager used to spend her Mondays rebuilding the week after cancellations. The agent now proposes the fills before she's had coffee — she just approves or bins them.”
“I stopped asking for reports. I ask questions. ‘Which practitioner's rebooking rate dropped this month, and against what?’ — answered mid-call, from live data.”
“The draft-first rule is what got it past our compliance review. Nothing reaches a patient without a named person pressing send, and we can prove it.”
The Model Context Protocol is an open standard for how AI agents talk to software. Instead of an agent scraping your screen or reverse-engineering an API, the software publishes a list of tools — each with a name, a description and a typed schema. The agent reads that list and calls what it needs. MCP is the protocol; ClinicSoftware MCP is our implementation of it over the clinic platform.
No. A chatbot answers. This executes. There's no conversation designer, no intent tree and no scripted flow — the agent decides which tools to call based on what you asked and what the schemas allow. You can drive it from a chat window, from Cursor, or from nothing at all if you run it on a schedule.
Not without a deliberate decision on your side. Every connection starts read-only. Write tools are enabled individually, per site. Anything client-facing — SMS, email, WhatsApp — is composed as a draft and stops at an approval gate for a named human. Destructive operations aren't exposed as tools at all.
Any that speak MCP. Claude and GPT work out of the box; so does Cursor and any custom agent framework with an MCP client. We're deliberately model-agnostic — the server never calls an LLM itself.
To connect an off-the-shelf client, no — you authenticate, choose scopes and you're running. To build an autonomous agent with your own logic on top, yes, and the schemas are documented for exactly that.
Tool calls route through the existing application layer under your own tenant's permissions; data stays in your region. Nothing is used to train a model. The audit tape gives you a complete record of what was read, by whom and when — which is usually the first thing a DPO asks for.
Read-only access is included on Professional and above during the beta. Write scopes and autonomous scheduling are priced per site — talk to us and we'll size it against how many chairs you run.