Let an AI agent work with your practice data
HyperCRM runs a Model Context Protocol server: a single endpoint that MCP-capable clients like Claude Code or Claude Desktop can connect to, discover 60 tools, and use to work with patients, scheduling, billing, forms and reporting — always scoped to your own practice and authorized under OAuth 2.1.
What an agent can do today
Run the front desk
Find patients, read and write their records and notes, book and reschedule appointments, and check which chairs are free on a given day.
Handle the money
Record billing entries, preview what a patient owes, issue and void invoices, and pull revenue, appointment and acquisition reports.
Keep the practice tidy
Manage the service catalogue, chairs, tags and intake forms, read submitted responses, and edit and publish the practice website.
Which plan this needs
The REST API and the MCP server are included on the Complete plan and are not available on Essential — integrations are a larger-practice need and a real support burden, so they sit on the plan that pays for them. The pricing page lists every band. OAuth clients are created from practice settings once you are on Complete.
What it is
The MCP server speaks JSON-RPC 2.0 over a single HTTP endpoint, following the same streamable-http transport pattern used by other MCP servers. An MCP client calls initialize, lists the available tools with tools/list, and invokes one with tools/call — no custom protocol to learn beyond MCP itself.
Signing in an agent
Connecting is a standards-based OAuth 2.1 flow: the client registers itself automatically (no manual API key to generate), opens HyperCRM's normal sign-in and a plain-language consent screen — "<client name> wants to access your HyperCRM data as <your email>" — and, once approved, receives a short-lived access token plus a refresh token. A raw Firebase ID token still works too, for setups that predate the OAuth flow. Every tool call is scoped strictly to the signed-in user's own practice; nothing in the request can override that.
What the tools do today
60 tools cover patients and their notes, files, billing and invoices; the appointment calendar and chair availability; the service catalogue, chairs and tags; intake forms and their responses; staff and invitations; dashboard KPIs, revenue and acquisition reporting, the audit log and search across the practice; and the marketing website builder with its blog. 38 are read-only. The rest are grouped so that creating, updating and deleting one kind of record is a single tool with an explicit action, and every tool tells the client up front whether it deletes data or reaches outside HyperCRM.
Where the boundaries are
A few things are deliberately left out rather than half-supported. Uploading a file is a browser-to-storage transfer that never passes through the server, so an agent cannot do it — it can read, download and delete files, but you upload them yourself. The public booking widget, the passkey enrolment ceremonies and the OAuth endpoints an agent uses to sign in are all absent by design. CSV export stays a REST API feature; MCP tools always return structured JSON.
Scope, and what is not finished
No tool can be pointed at another practice: the practice comes from your token, never from a tool argument. Two things are genuinely unfinished: no MCP resources or prompts are exposed yet, and the server has not been through a broad real-world shakedown across every client. The full reference is at MCP server, and every one of the 60 tools is listed with its arguments and permissions at MCP tools.
Common questions
HyperCRM is paid software. Every practice starts with a 30-day free trial of the full Complete plan, with no card required. After that, plans start at €19 and €29 a month excluding VAT, banded by how many practitioners you have. Every price is printed on the pricing page rather than quoted on a call.
Patient records are encrypted in transit and at rest, files are stored privately and served through short-lived signed links, and every change is written to an audit log. Staff accounts sign in with passkeys rather than shared passwords.
Any MCP-capable client that supports the streamable-HTTP transport and the MCP authorization spec, such as Claude Code or Claude Desktop. Connection is a single endpoint URL plus the standard OAuth 2.1 discovery flow — there is no HyperCRM-specific client library to install.
It's a real login. Approving a client happens through HyperCRM's normal sign-in and a consent screen naming the client and your account, using OAuth 2.1 with mandatory PKCE. No shared API key is issued, and a client's access can be revoked the same way any authorization can.
No. Every tool call is scoped to the practice belonging to whichever account approved the connection, resolved from the authenticated token itself. Nothing an agent passes as an argument can widen that scope, matching how the REST API is scoped for the same account.
Connect an agent to real practice data
Point a client at your own practice and see what the tools return. No card to start.
Start the free trial