AI Connectors - BookAndGo

Two ways to connect

Via the AndGo platform

Connect once at myandgo.com.au. Your AI sees everything you've subscribed to across the AndGo ecosystem (BookAndGo, ShareAndGo, SignAndGo, …) under a single consent.

Direct user token

For BookAndGo-only use. Walk the OAuth 2.1 + PKCE flow yourself, get a bag_ai_* token, plug it into your MCP client. Works without an AndGo platform subscription.

What can it do?

Eight tools, four read + four write:

Read	Write
`list_bookings`	`create_booking`
`get_calendar`	`reschedule`
`find_slot`	`cancel_booking`
`list_attendees`	`add_attendee`

Privacy model

Default-off everywhere. A connected AI sees nothing until you opt in.

Two layers of consent: token scope (read / write) at the OAuth flow, AND a per-booking flag on each appointment.

Audit trail: every tool call is recorded. Settings → AI Assistants shows who saw what, when.

Revoke any time. Tokens can be killed instantly from the same panel.

Endpoints

# OAuth 2.1 discovery
GET  /.well-known/oauth-protected-resource
GET  /.well-known/oauth-authorization-server

# OAuth flow
POST /api/oauth/register     # RFC 7591 dynamic client registration
GET  /api/oauth/authorize    # bounces to /oauth/consent
POST /api/oauth/code         # consent page calls this; mints code
POST /api/oauth/token        # form-urlencoded; exchanges code for bag_ai_*

# MCP
POST /api/mcp/v1             # JSON-RPC: initialize, ping, tools/list, tools/call
GET  /api/mcp/v1             # SSE keep-alive

# Federation (server-to-server, AndGo platform only)
POST /api/internal/exchange-federation-token

Quickstart - direct user token

The smoke recipe at scripts/smoke-mcp-day1.sh walks the full OAuth flow with curl in 9 steps. PKCE pair, DCR, code mint, token exchange, and tool calls.

Tenant setup

Open Settings → AI Assistants. Privacy defaults stay off - flip the toggles you want, and / or grant individual bookings access on the appointment detail.