# Fresha by Cotlet

> Appointments, clients, sales and reviews for salons and spas.

- name: dev.cotlet/fresha
- version: 1.0.2
- connection class: R1 (autonomous)
- trust: 95/100
- quality: 82/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.cotlet%2Ffresha
- tools: https://api.protogrid.dev/v1/servers/dev.cotlet%2Ffresha/tools

**An agent can connect on its own if it already holds `FRESHA_TOKEN`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "fresha": {
      "type": "http",
      "url": "https://cotlet.dev/mcp/v1/fresha",
      "headers": {
        "Authorization": "Bearer ${FRESHA_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${FRESHA_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 99
- freshness: 100
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-98% +updated-14d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 82/100 (good)

### protocol: 100 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- pass `protocol.list_ttl`: tool list is cacheable (ttlMs 300000)

### authorization: 100 (weight 15)

- pass `auth.prm`: Protected Resource Metadata (RFC 9728) published
- pass `auth.as_metadata`: authorization server metadata reachable
- pass `auth.cimd`: Client ID Metadata Documents supported
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 39 of 39 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 34 of 39 tools declare all four hints; missing: cotlet_upload_file (idempotentHint); cotlet_whoami (idempotentHint); cotlet_apps (idempotentHint); …
- warn `tools.token_cost`: about 11,030 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 66 tool changes in 30 days
- fail `stability.rug_pull`: 17 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: deps.dev does not know fresha-api-mcp@1.0.3

- tools: 39, about 11,030 tokens to load them all
- tool set hash: 74aa6983044fcc18869433bfc839cecd
- tools last changed: 2026-11-07T15:58:38.855Z
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.cotlet/fresha.svg)](https://protogrid.dev/servers/dev.cotlet/fresha)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-11-07 `cotlet_report_issue` changed (description, inputSchema)
  - before: Sends a report straight to the Cotlet team: a tool that failed or returned wrong data, an error you could not get past, or a tool, field or app the task needed and Cotlet lacks. The report carries the error text and call_id when there is one, never passwords or tokens. Needs the user's Cotlet API key or sign-in.
  - after: Sends a report to the Cotlet team: a tool that failed or returned wrong data, an error you could not get past, or a step the browser could not do, with the page, the step and what you saw. A missing dedicated tool is not a problem to report: do the task in the browser. A feature the user asks for goes as feature_request. A report promises nothing: tell the user it was sent, never that something will be built or fixed, or when. The report carries the error text and call_id when there is one, never passwords or tokens. Needs the user's Cotlet API key or sign-in.
- 2026-11-07 `cotlet_request_apps` changed (description)
  - before: Requests access to apps for the user's workspace, as Request access in the console: every app is granted at once. An app with dedicated tools gets them after the user signs in to it in their Cloud Browser; any other works now in the user's Web browser with cotlet_app_guide, and the Cotlet team builds its dedicated tools on demand. Takes app slugs as listed at https://cotlet.dev/api/v1/apps. Free. Needs the user's Cotlet API key or sign-in.
  - after: Requests access to apps for the user's workspace, as Request access in the console: every app is granted at once. Not needed to work in an app: the user's AI works in any web app in their Web browser with cotlet_app_guide. An app with dedicated tools gets them after the user signs in to it in their Cloud Browser. Access says nothing about whether a task works there: check that in the browser. Takes app slugs as listed at https://cotlet.dev/api/v1/apps. Free. Needs the user's Cotlet API key or sign-in.
- 2026-11-06 `cotlet_browser_drag` changed (inputSchema)
- 2026-11-06 `cotlet_browser_back` changed (inputSchema)
- 2026-11-06 `cotlet_browser_press` changed (inputSchema)
- 2026-11-06 `cotlet_browser_select` changed (inputSchema)
- 2026-11-06 `cotlet_browser_type` changed (inputSchema)
- 2026-11-06 `cotlet_browser_click` changed (inputSchema)
- 2026-11-06 `cotlet_browser_open` changed (description)
  - before: Wakes the user's Fresha Cloud Browser, a real Chrome hosted on Cotlet and signed in to Fresha as the user. Use it for what the Fresha tools do not cover. Opens `url` when given and returns the page's URL and title. The user watches every step live. Before the first step in an app, Cotlet's app guide says which browser to use and how to work in the app. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
  - after: Wakes the user's Fresha Cloud Browser, a real Chrome hosted on Cotlet and signed in to Fresha as the user. Use it for what the Fresha tools do not cover. Opens `url` when given and returns the page's URL, title and tab. In the web browser `url` opens in the open tab of the same site, else in a new tab when the shown tab already has a site open (at the tab limit in the tab you opened and used longest ago), so the user's other apps stay as they are (the tabs tool lists them). The user watches every step live. Before the first step in an app, Cotlet's app guide says which browser to use and how to work in the app. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- 2026-11-02 `cotlet_app_guide` added
  - How to work in an app by clicking in the user's Cloud Browser with Cotlet's browser tools: which browser to use for this workspace and the sign-in link, the method step by step, the app's screens, menus and actions, notes, and the app's dedicated tools when Cotlet has them. Call it before the first browser step in an app. Works for any web app; one outside Cotlet's catalog gets the general method. Free, no browser session.

Full history: https://api.protogrid.dev/v1/servers/dev.cotlet%2Ffresha/changes

## Dependencies

- pypi fresha-api-mcp@1.0.3: unknown

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://cotlet.dev/mcp/v1/fresha/connect (streamable-http, auth oauth2, reachable true, uptime30d 0.98333335)
- https://cotlet.dev/mcp/v1/fresha (streamable-http, auth api_key ${FRESHA_TOKEN}, reachable true, uptime30d 0.94736844)

## Packages

- pypi fresha-api-mcp@1.0.3

## Tools (39)

- `add_blocked_time`: Block a time slot in a team member's calendar so nobody books it. Adds blocked time as Add > Blocked time in the calendar does: one block on one day for one team member at one location (default: their primary location), with a title and a note for the team. It does not repeat. Clients cannot book it online unless allow_online_booking is true. Nobody is told.
- `add_client`: Add a client to the business's client list. Adds a client as Add client in the Client list does: name, email, mobile and gender. With appointment_messages (default true) Fresha sends the client booking confirmations and reminders to the email and mobile given; marketing (default false) records consent to marketing messages. Nothing is sent when the client is added.
- `add_client_note`: Add a note to a client's profile, seen by the team only. Adds a note to the client's Notes tab for all locations, as the profile's Add note does. Only the team sees it; the client is not told. Line breaks become paragraphs.
- `cancel_appointment`: Cancel an appointment without a charge, optionally telling the client. Cancels the appointment as Cancel in its drawer does, with one of the business's cancellation reasons. With notify_client (default true) Fresha sends the client a cancellation message, so this can reach the client; false cancels quietly. whole_series also cancels the later appointments of a repeating series. An appointment with a cancellation fee or a paid deposit is refused: cancel it in Fresha. It cannot be undone here. By default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.
- `cotlet_app_guide`: How to work in an app by clicking in the user's Cloud Browser with Cotlet's browser tools: which browser to use for this workspace and the sign-in link, the method step by step, the app's screens, menus and actions, notes, and the app's dedicated tools when Cotlet has them. Call it before the first browser step in an app. Works for any web app; one outside Cotlet's catalog gets the general method. Free, no browser session.
- `cotlet_apps`: The apps of the user's workspace and whether each works now: access granted or requested, the app account in the user's Cloud Browser (connected, signed out, signed in but not connected), and the one step the user has to take, with the console link. Free. Needs the user's Cotlet API key or sign-in.
- `cotlet_browser_back`: Goes back one page in the user's Fresha Cloud Browser, like the browser's Back button (with `forward`, forward again). Returns the URL and title. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_click`: Clicks a link, button, option or other element of the current page in the user's Fresha Cloud Browser, by its number in the page's element list, or a point of the screenshot (`x`, `y`) for boards, canvases and maps. Returns the URL and title after the click, and says when nothing on the page changed. It acts as the user on that site. Buttons that pay or buy and buttons on account or sign-in pages are refused. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_close`: Ends the session in the user's Fresha Cloud Browser: the browser keeps its cookies, goes to sleep and the per-minute charge stops. Returns the session's minutes and credits.
- `cotlet_browser_drag`: Drags from one element or point of the screenshot to another in the user's Fresha Cloud Browser: a piece on a board, a card between columns, a field into a form builder, a slider's handle. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_hover`: Rests the pointer on an element of the current page (or a point of the screenshot) in the user's Fresha Cloud Browser, as a person does to open a hover menu, a tooltip or a card's preview. Read after it for what opened. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_navigate`: Opens a public http or https address in the user's Fresha Cloud Browser and returns the URL and title it ended on. Only Fresha pages open. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_open`: Wakes the user's Fresha Cloud Browser, a real Chrome hosted on Cotlet and signed in to Fresha as the user. Use it for what the Fresha tools do not cover. Opens `url` when given and returns the page's URL, title and tab. In the web browser `url` opens in the open tab of the same site, else in a new tab when the shown tab already has a site open (at the tab limit in the tab you opened and used longest ago), so the user's other apps stay as they are (the tabs tool lists them). The user watches every step live. Before the first step in an app, Cotlet's app guide says which browser to use and how to work in the app. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_press`: Presses a key on the current page in the user's Fresha Cloud Browser, on the element that has focus: Tab to the next field, Enter to send, Escape to close a dialog or pop-up, arrows to move through a suggestion list or a slider, or one character (a site's shortcut). Returns the URL and title after it, and says when nothing changed. Enter on account pages and characters into password fields are refused. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_read`: Returns the current page of the user's Fresha Cloud Browser: its readable text, up to 20,000 characters, and a numbered list of its links, buttons, fields, options and toggles, also inside frames. Open dialogs and cookie banners come first: they cover the page, so close or answer them first. Field values, cookies and storage are never returned. On a page longer than that, both start near where it is scrolled to; `element` reads only the part inside that element (a dialog, a form, a list). Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_screenshot`: Returns a JPEG image of the visible part of the current page in the user's Fresha Cloud Browser, with its URL and title: boards, canvases and layouts that the page text does not show. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_scroll`: Scrolls the current page in the user's Fresha Cloud Browser with the mouse wheel, as a person does: down or up by `screens` viewport heights (default 0.8), to the top or the bottom, or until element `element` is in view. Content that loads on scroll appears, and the next read lists it. Returns the URL, title and scroll position (at_top, at_bottom). Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_select`: Chooses an option of a drop-down list on the current page in the user's Fresha Cloud Browser, by the list's number in the element list and the option's label as read lists it (or its value). Returns the URL and title after it. Card fields and account pages are refused. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_type`: Types text into a field of the current page in the user's Fresha Cloud Browser, by the field's number in the page's element list, and with `submit` presses Enter. Returns the URL and title after it. Password, card and one-time code fields and sign-in pages are refused: the user fills those in themselves. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_upload`: Puts files into a file field of the current page in the user's Fresha Cloud Browser, or into the file picker that an upload button opens, by its number in the element list. A file is given as {"url": "https://..."} for a file online or {"file_id": "..."} for one uploaded to Cotlet first; up to 10 files, 20 MB each. Returns the URL and title after it. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_browser_wait`: Waits until `text` shows on the current page in the user's Fresha Cloud Browser (at most `seconds`, default 5, up to 20), or just `seconds` without text: for results, prices or a page that load slowly. Says whether the text appeared. Run browser steps one at a time and wait for each answer; steps sent together run in no set order. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
- `cotlet_get_call`: Status of an earlier Cotlet call, by its call_id: pending (waits for the owner's approval in the Cotlet console), approved, running, success, rejected, expired, blocked or failed. For a call that answered with status pending or running.
- `cotlet_report_issue`: Sends a report to the Cotlet team: a tool that failed or returned wrong data, an error you could not get past, or a step the browser could not do, with the page, the step and what you saw. A missing dedicated tool is not a problem to report: do the task in the browser. A feature the user asks for goes as feature_request. A report promises nothing: tell the user it was sent, never that something will be built or fixed, or when. The report carries the error text and call_id when there is one, never passwords or tokens. Needs the user's Cotlet API key or sign-in.
- `cotlet_request_apps`: Requests access to apps for the user's workspace, as Request access in the console: every app is granted at once. Not needed to work in an app: the user's AI works in any web app in their Web browser with cotlet_app_guide. An app with dedicated tools gets them after the user signs in to it in their Cloud Browser. Access says nothing about whether a task works there: check that in the browser. Takes app slugs as listed at https://cotlet.dev/api/v1/apps. Free. Needs the user's Cotlet API key or sign-in.
- `cotlet_upload_file`: Returns a one-time upload_url and a file_id for a local file (an image for a post, an attachment). The file is sent to upload_url with an HTTP PUT; an argument that takes a file accepts {"file_id": "..."}. Up to 25 MB, the URL works once. Free. Needs the user's Cotlet API key or sign-in.
- `cotlet_whoami`: The Cotlet account this connection acts as: email, workspace, access status, the API key or OAuth client in use with its scope, the apps the workspace may call and its credit balance. Free. Needs the user's Cotlet API key or sign-in.
- `create_appointment`: Book an appointment for a client: services, team member and start time. Books the services one after another from start_at with one team member at one location, as New appointment in the calendar does, at each service's catalogue price. Give service_ids (service_id from list_services), or pricing_level_ids to pick a pricing level other than a service's first. In a business with several locations, pass location_id and a team member who works there (location_ids in list_team_members); without it the team member's primary location is used. Fresha may send the client a booking confirmation by their notification settings (get_client), so this can reach the client. Find free times with find_available_slots first: Fresha books over other appointments and returns its warnings. By default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.
- `find_available_slots`: Free start times for one or more services with a team member, day by day. Asks the calendar for free start times as New appointment does, for the services done one after another, with one team member at one location, over up to 14 days. Give service_ids (service_id from list_services), or pricing_level_ids to pick a pricing level other than a service's first. In a business with several locations, pass location_id and a team member who works there (location_ids in list_team_members); without it the team member's primary location is used. Times are wall clock in the business's time zone; closed days have no times. Book a time with create_appointment, with the same team member and location.
- `get_appointment`: One appointment: client, services, team member, times, status, price and notes. Reads the appointment as its drawer in the calendar shows it: status, start and end (wall clock in the business's time zone), the client, each booked service with its team member and length, the total and what is left to pay, and the appointment notes.
- `get_client`: One client: contact, notification settings, booking stats, upcoming appointments, notes. Reads the client profile as the client's page shows it: name, email, mobile, gender, birthday, whether Fresha sends them appointment messages and marketing by email, SMS and WhatsApp, booking and sales totals, the next 10 appointments and the latest 10 notes.
- `get_sales_summary`: Sales summary for a period: sales, refunds, discounts, taxes and payments by type. Reads Reports > Sales summary for the days given: one row per sale type (services, products, memberships, gift cards and so on) with Fresha's own columns (gross and net sales, discounts, refunds, taxes) and a totals row. columns names each key. A period without sales has no rows. Amounts are in the business's currency.
- `list_appointments`: Appointments in a date range, with client, service, team member, price and status. Lists appointments that start between from and to (both days included; from defaults to today, to to from) as Sales > Appointments shows them, latest first: one row per booked service with its appointment id, reference, start (wall clock in the business's time zone), length, client, team member, price, status and channel (online or offline). Cancelled appointments are included with their status. location_id keeps one location of a business with several. Page with next_cursor. The report itself has no status, team member or client filter, so those three apply to the first 100 rows of the date range: for a busy range, narrow the dates.
- `list_clients`: Clients of the business, searchable by name, email or phone. Lists clients as the Client list shows them, newest first by default, with email, mobile, gender, total sales, review count and whether they are blocked. search matches name, email or phone. total is the number of matching clients. Page with next_cursor.
- `list_reviews`: Client reviews of the business with rating, text and replies. Lists reviews as Online reputation shows them, newest first: star rating, text, author, the client and appointment it is about, source (Fresha or Google) and the replies. Filter by rating, source, words or reviews still without a reply. Page with next_cursor.
- `list_sales`: Sales (invoices) in a date range: number, date, client, status and totals. Lists sales as Sales > Sales list shows them for the days given, one row per sale with Fresha's columns (sale number, date, client, status, gross total and so on; linked records come with an `_id`). Amounts are in the business's currency. Page with next_cursor.
- `list_services`: Services of the business with category, duration and price. Lists the active services of one location as the Catalogue shows them, with their category, duration in minutes, price and whether clients can book them online. A business with several locations: pass location_id (from list_team_members) and use the same location_id when you book. A service with several prices (by length or level) lists each as a pricing level; service_ids book the first one, pricing_level_ids a chosen one. Use service_id in find_available_slots and create_appointment.
- `list_team_members`: Team members with role, contact, services they do and whether they take bookings. Lists the team as Team members shows it: name, email, mobile, role (owner, manager, basic), job title, whether they take bookings and online bookings, the services assigned to them, their primary location (location_id) and every location they work at (location_ids). Also lists the business's locations. Use team_member_id in the calendar tools, with location_id set to one of that member's location_ids when the business has several.
- `reply_to_review`: Post a public reply to a client's review. Posts a reply under the review as Reply in Online reputation does, signed as the business or the team member. The reply is public on the business's Fresha page and the client is told, so this reaches people. It needs a review that exists: take review_id from list_reviews. By default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.
- `reschedule_appointment`: Move an appointment to a new start time, optionally to another team member. Moves every service of the appointment by the same amount so the first starts at start_at, as Reschedule in the appointment drawer does; lengths and prices stay. team_member_id moves all services to that team member, who must work at the appointment's location (location_ids in list_team_members); the location itself stays. With notify_client (default true) Fresha sends the client a reschedule message by their notification settings; false moves it quietly. Cancelled, completed and no-show appointments are refused. By default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.