Your salon, in Claude and ChatGPT

The HiSalon connector for apps that support the Model Context Protocol (MCP)

Connect an AI app to your salon on HiSalon and ask it about your day, your customers and your menu in plain words, in Arabic or English. With full access it can also book, move a booking, add a customer or change a price for you. The app asks you before every change, every change is recorded, and almost every change can be undone with one click.

1. Connect

The connector's address is:

https://api.hisalon.ai/mcp

Each salon also has its own address, https://api.hisalon.ai/<your-salon>/mcp, which only ever connects to that salon. Both are shown, with a copy button, on the AI connectors page in the HiSalon dashboard.

Claude (claude.ai and Claude Desktop)

1. Open Settings, then Connectors, then Add custom connector.
2. Name it HiSalon and paste the address above.
3. Press Connect. HiSalon opens; sign in if you are not already.
4. Choose Full access or Read only and press Allow.

Claude Code

claude mcp add --transport http hisalon https://api.hisalon.ai/mcp, then run /mcp and choose HiSalon to sign in.

ChatGPT and other MCP apps

Add a remote MCP server (Streamable HTTP) with the address above. The app finds HiSalon's sign-in by itself (OAuth 2.1), and you approve it in HiSalon the same way.

2. Access and permissions

• One salon per connection. The connection belongs to the salon you were in when you pressed Allow. A member of two salons connects each one separately.
• Your role, exactly. The connector acts as you, with your role's permissions in HiSalon. A receptionist's connector can do what a receptionist can do, and no more.
• Full access or read only. Read only can look but never change anything. You choose on the consent screen.
• Who can connect. The salon owner, or a member with the Integrations permission.
• Disconnect any time from the AI connectors page. It stops at once.

3. What it can do

• Your day at a glance: today's bookings and revenue against the previous period, the schedule, no-shows, low stock and what needs attention.
• Bookings: find bookings, check free times for one or more services, book a visit, move a booking to another time or stylist, confirm, check in, complete, mark a no-show or cancel.
• Customers: search by name or phone in Arabic or English, read a customer's file and history, add a customer, correct details, add a note.
• Menu and team: list services, add a service, change a price, duration or name, list staff and their hours, block time on the calendar.
• Money and stock, read only: sales reports, invoices, low stock, the waiting list and reviews.

4. What stays in the dashboard

Anything that moves money or cannot be taken back is never available through a connector: taking payments, refunds, voiding invoices, issuing or redeeming gift cards and loyalty, salaries and commissions, the till's PIN and terminal, and your HiSalon subscription. Cancelling a visit that has a payment on it is also done in the dashboard, where the refund is decided.

5. Every change is recorded and undoable

Every change a connector makes is listed on the AI connectors page with what it was before and after, who made it and through which app. Press Undo there, or ask the app to undo it. Before an undo, HiSalon checks the record again: if someone changed it since, the undo is refused rather than overwriting their work. A booking's status (cancel, complete, no-show) only moves forward, so those changes cannot be undone, and the app is told to ask you first.

6. Memory

You can ask the connector to remember things for next time ("we open at 2 PM on Fridays", "hafaf means threading"). Memories for the whole salon need the owner or the AI agent permission; anyone can keep their own. Passwords, card numbers, keys and ID numbers are refused. You can edit or forget any memory on the AI connectors page.

7. Security

• Sign-in with OAuth 2.1 and PKCE; HiSalon never sees or stores the AI app's credentials, and the app never sees your password.
• Access tokens expire after one hour, refresh tokens after 30 days, and both are stored only as hashes. A refresh token used twice ends the connection.
• Every request is limited to your salon by the database itself (row-level security), and a token granted for one address is refused at another.
• More detail on what is collected and kept is in section 13 of the Privacy Policy.