Ava Research

Open Slot — Docs

Turn your business into something people can book, right through Muse.

Open Slot is a hosted MCP (Model Context Protocol) server. A business owner publishes services and hours once; a customer finds open times and requests an appointment; the owner approves or declines in chat. Nothing is booked without that explicit approval.

Free. No paid plan. Looking up a business and searching its open times work without an account. Requesting, managing, or deleting bookings require a free account, created with a one-time code sent to your email — no password, no payment details.

Endpoint

https://func-open-slot-prod-clay6w.azurewebsites.net/api/mcp

JSON-RPC 2.0 over HTTPS POST. Methods: initialize, tools/list, tools/call. MCP protocol version 2025-06-18.

Authentication

Sign-in uses OAuth with Microsoft Entra External ID: Muse gets an access token from Entra, and the server accepts only Entra-issued tokens with the OpenSlot.ReadWrite scope. The server publishes protected-resource metadata (RFC 9728) and returns 401 with a WWW-Authenticate header pointing to it. Tokens are validated on every call: signature, issuer, audience, expiry, and scope. The same account works as both a business owner and a customer — every tool except get_business and search_slots needs a signed-in user.

Tools

  • get_business · Sign-in: No
    Looks up a business by its public booking link: name, active services (with duration and price), and cancellation terms.
    Inputs: publicSlug.
    Example: “What services does this business offer, and what's their cancellation policy?”
    Errors: business_not_found.

  • search_slots · Sign-in: No
    Finds open appointment times for a business's service within a date range. Candidates only — nothing is held until request_booking is called.
    Inputs: publicSlug, serviceId, fromDateString, toDateString (inclusive, range capped at 60 days).
    Example: “What times are open for a haircut this week?”
    Errors: business_not_found, service_not_found, invalid_range.

  • request_booking · Sign-in: Yes
    Requests an appointment for a specific open slot. Holds that time immediately so no one else can take it, but it stays pending until the business approves it.
    Inputs: publicSlug, serviceId, startIso (from search_slots), customerContact.
    Example: “Book the 2pm slot for a haircut.”
    Errors: business_not_found, service_not_found, slot_taken.

  • list_my_bookings · Sign-in: Yes
    Lists the signed-in customer's own bookings across every business, newest first. Each entry includes reminderDue — true if it's approved and starts within 24 hours.
    Inputs: None.
    Example: “What have I got booked?”

  • list_business_bookings · Sign-in: Yes (owner)
    Lists bookings for the signed-in owner's own business — the approval queue.
    Inputs: status (optional: pending, approved, declined, or cancelled).
    Example: “What needs my attention?”

  • decide_booking · Sign-in: Yes (owner)
    Approves or declines a pending booking on the owner's own business. There is no auto-approve path — every booking needs this explicit call.
    Inputs: bookingId, status (approved or declined).
    Example: “Approve that request.”
    Errors: not_found, already_decided.

  • cancel_booking · Sign-in: Yes
    Cancels a booking. Either the business owner or the customer who made it may call this.
    Inputs: businessIdHash (from the booking's own record), bookingId.
    Example: “Cancel my appointment.”
    Errors: not_found, already_decided, forbidden.

  • reschedule_booking · Sign-in: Yes
    Moves a booking to a new open time, for either the owner or the customer who made it. If it was already approved, this resets it to pending — the business must approve the new time fresh.
    Inputs: businessIdHash, bookingId, newStartIso.
    Example: “Move my appointment to Thursday instead.”
    Errors: not_found, already_decided, forbidden, slot_taken.

  • delete_my_business · Sign-in: Yes (owner) · Permanent
    Deletes the signed-in owner's business profile and every booking ever made with it. This can't be undone.
    Inputs: None.
    Example: “Delete my business.”
    Errors: business_not_found.

  • delete_my_data · Sign-in: Yes · Permanent
    Deletes every booking the signed-in customer has ever made, across every business. This can't be undone.
    Inputs: None.
    Example: “Delete all my Open Slot data.”

Errors

If the token is missing, expired, or lacks OpenSlot.ReadWrite, tools that need sign-in return HTTP 401 with a WWW-Authenticate header. Tool errors come back as a result with isError set to true and a short, readable message; the codes are listed with each tool above.

Limits

  • No connector-specific rate limit is enforced or published.

  • Date ranges for search_slots are capped at 60 days per call.

  • delete_my_business and delete_my_data are permanent — there is no undo, and Muse will ask for confirmation every time, never "always allow."

What it won't do

  • There's no payment step in this version.

  • It never confirms a booking without the business's explicit approval.

  • It doesn't send push notifications — reminders surface when you or Muse check, same as asking any other time.

  • It shares nothing with advertisers.

Questions? support@avaresearchllc.com · Back to Open Slot