Set up AI agent access and MCP

Open Settings, then AI agents. New businesses start with agent access disabled.

Enable AI agent access only after the Business owner has reviewed the allowed actions and security policy.

Choose whether authorized agents can book appointments, reschedule appointments, cancel appointments, or only read appointment information.

Keep user confirmation enabled for bookings and changes unless the business has a documented reason to allow unattended writes.

Use staff approval for agent-created bookings when service providers need to review requests before they are confirmed.

Set booking lead time, cancellation notice, and hold duration so agents cannot reserve inappropriate last-minute slots.

Keep invoices, forms, and client notes hidden from agents unless the business has completed a privacy review for those data types.

Register only trusted agent clients with approved redirect URLs and the minimum scopes needed for their use case.

Share the machine-readable discovery endpoints with reviewed developers: /.well-known/schedmo-agent.json, /agent/openapi.json, and /agent/mcp.

Monitor agent action logs for denied scopes, failed attempts, unusual booking activity, and revoked consent grants.

If a client reports unwanted agent activity, revoke the consent grant from the agent consents view and review the audit log before re-enabling access.