AI Agents · MCP

Let an AI run your marketing — safely.

Connect Claude or any LLM to QuickGrow through a standards-based OAuth 2.1 server and a Model Context Protocol server exposing 30 tools — with consent, scopes, and a human confirmation before anything sends.

OAuth 2.1 · PKCE30 MCP toolsHuman confirm before send
mcp · tool call
→ tool campaign.schedule
  { "id": "cmp_31", "when": "2026-08-11T09:00Z" }

⧗ awaiting human confirmation…

✓ confirmed by owner → scheduled

Standards, not lock-in.

A spec-compliant OAuth 2.1 authorization server — PKCE, dynamic client registration, and .well-known discovery — issues the tokens; the MCP endpoint speaks the Model Context Protocol. Any conformant client can connect.

PKCE (S256)Dynamic client registration.well-known discovery
discovery
GET /.well-known/oauth-authorization-server

{
  "authorization_endpoint": ".../oauth/authorize",
  "token_endpoint": ".../oauth/token",
  "code_challenge_methods_supported": ["S256"],
  "registration_endpoint": ".../oauth/register"
}

Thirty real tools — the same services the app uses.

Agents work with contacts, segments, leads, campaigns across email, SMS, and WhatsApp, templates, automations, forms, and analytics. No shadow API — the MCP tools call the same services that power the product.

Contacts Segments Leads Campaigns · Email Campaigns · SMS Campaigns · WhatsApp Templates Automations Forms Analytics

Safe by design.

An agent gets exactly the access you grant — and nothing an owner hasn’t approved. Every send or schedule stops for a two-step human confirmation before it goes out.

Per-brand consent

Each brand grants access on first use — an agent can only touch brands it has been connected to.

Scoped permissions

Tokens carry least-privilege scopes; a read-only agent can never quietly gain send rights.

Rate limits

Agent traffic is rate-limited per key, so an automated loop can’t run away with your account.

Database-level isolation

Every tool call runs under Postgres row-level security — one brand’s data can’t leak into another.

Audit logging

Who did what, and when — every agent action is written to an audit trail you can review.

Two-step human confirm

Before an agent can send or schedule a campaign, a person has to confirm — no silent blasts.

⚠ New and distinctive — configure your issuer URLs and connected-apps consent before going live.

Give an AI the keys — and keep your hand on the switch.

Product screens shown across this site are captured from the live application using a demo workspace. All names, contacts and figures in them are synthetic.