Aura 300 Booking is agentic booking for hair salons. It's a remote MCP (Model Context Protocol) server that lets AI assistants — Claude, ChatGPT, and any other MCP-compatible agent — search participating businesses, check real-time availability, and book, reschedule, or cancel appointments, in natural language, directly against that business's own booking system (CRM). The same broker also powers a simple end-customer chat page per salon, so a business's own customers can book by chatting, no app required.
| Transport | MCP over Streamable HTTP |
|---|---|
| URL | https://booking.aura300.ai/mcp |
| Auth | OAuth 2.1 (public/directory clients) or a private bearer token (internal integrations) |
| Tool | Type | Description |
|---|---|---|
search_salons | read | Find bookable salons by name or handle, optionally filtered by city. |
get_services | read | List services and staff for a salon. |
search_availability | read | Find available slots for a service in a date range. |
book | write | Create a booking. Two-step: may come back held pending a verification step, or confirmed immediately depending on the salon's policy. |
confirm_booking | write | Complete a held booking after the customer completes the secure hosted browser verification link. |
find_bookings | read | Look up a customer's upcoming bookings by phone number. |
cancel_booking | write | Cancel a booking. |
reschedule_booking | write | Move a confirmed booking to a new time — same booking, updated in place. |
request_booking_access | write | Request a hosted browser verification link for booking access. |
Every tool declares a title, input and output schemas, and explicit readOnlyHint, destructiveHint, and openWorldHint annotations.
Aura 300 Booking implements the MCP authorization spec: OAuth 2.1 with mandatory PKCE (S256), protected-resource metadata, and dynamic client registration. Connecting applications do not need a pre-shared secret.
| Protected-resource metadata | GET /.well-known/oauth-protected-resource (RFC 9728) |
|---|---|
| Authorization-server metadata | GET /.well-known/oauth-authorization-server (RFC 8414) |
| Dynamic client registration | POST /oauth/register (RFC 7591) |
| Authorize | GET/POST /oauth/authorize — PKCE S256 required, plain not supported |
| Token | POST /oauth/token — authorization_code and refresh_token grants |
| Scopes | booking:read, booking:write |
Full discovery URLs:
https://booking.aura300.ai/.well-known/oauth-protected-resource
https://booking.aura300.ai/.well-known/oauth-authorization-server
An unauthenticated request to the MCP endpoint receives 401 with a WWW-Authenticate: Bearer resource_metadata="…" challenge pointing at the protected-resource metadata above, per spec.
https://booking.aura300.ai/mcp. In Claude Code: claude mcp add --transport http aura-booking https://booking.aura300.ai/mcp.https://booking.aura300.ai/mcp.Bookings work at participating hair salons — see the live list at booking.aura300.ai/salons.
Times are always in the salon's local timezone.
https://booking.aura300.ai/mcp. Service status: /health returns "ok": true when the broker is up.Questions, bug reports, or integration help: info@aura300.ai. See our Privacy Policy for what data is processed and how.
Security: report a vulnerability or suspected misuse to info@aura300.ai with the subject "Security report". We acknowledge reports and investigate promptly.