Connect RetailHardHat to your AI assistant

RetailHardHat helps retail development teams manage sites, projects, budgets, procurement and field work. Connect your assistant to your organization's permitted records using the Model Context Protocol.

Account requirements

An active RetailHardHat organization owner or administrator account is required. Platform-admin privileges are not granted. Your provider account must support remote MCP connections.

Connect

1. In your AI provider, add a custom MCP connection using https://app.retailhardhat.com/api/mcp.
2. Sign in to RetailHardHat and review the requesting client's name and callback destination. Client names are self-declared, not proof of identity.
3. Choose the modules and read-only or guarded-write access you want to grant. Access cannot exceed the request.
4. Review or revoke linked connections in Settings → MCP.

Safety and approvals

Records are restricted to your organization, original grant, current administrator permissions and connection policy. Sensitive writes require human review by default; administrators can choose required or no-extra-review rules per connection, action or tool. Existing business approval workflows remain enforced. A pending approval is not an executed action. Required approval binds immutable exact arguments, expires and can be executed only once.

Settings → MCP → Security controls scoped permissions, document/export grants, field masking, persistent usage limits, approved OAuth registrations and emergency shutdown. Client names alone do not verify identity. Read the security reference or run the developer quickstart.

There are 440 tools across 18 modules, including two approval controls. Selected permissions determine which tools your assistant receives. No credentials, platform administration, raw SQL, unrestricted web requests, or payment execution are exposed.

Files and token lifetime

File tools require both organization and connection document permission. Uploads support approved application file types up to 50 MiB. File-content reads are limited to 2 MiB and may be further limited by sharing/quota rules. OAuth access tokens last one hour; refresh tokens rotate, last up to 30 days, and stop when the 90-day connection expires. Reusing an old refresh token revokes the connection. Role removal or suspension stops access.

Native operational dashboards

Compatible MCP Apps hosts can display an operations dashboard with authorized location selection, independent budget, opening-risk, bid and approval panels, searchable/sortable records, refresh and read-only drill-downs. Full-screen mode and Ask assistant appear where the host supports them. Other clients receive structured and text results. Views make no direct network requests and cannot approve or execute sensitive changes.

Try these workflows

• Open the interactive operations dashboard for a retail location.
• Summarize recorded budget overruns by category and inspect the underlying line items, keeping missing actual costs unknown.
• Identify overdue location tasks and rejected or expired permits, then inspect their records. These are risk signals, not readiness certification.
• Compare contractor bid amounts within the same location, category, project and RFP, and open a bid's recorded details.
• Show this AI connection's pending approvals without executing them.
• Display a focused interactive budget or bid comparison table.

Provider setup

• ChatGPT / Codex: Upload the OpenAI package, connect with OAuth/DCR, complete domain verification, test with a populated reviewer account, and submit for review.
• Claude: Choose MCP connector, enter the endpoint, link your account with OAuth, validate all permitted tools, add listing materials and reviewer access, then submit.
• Gemini: Add a custom app using the MCP endpoint on a supported account. Validate account linking and tools. Custom connection is not a public-directory listing; a self-service directory submission route has not been established.
• Microsoft 365 Copilot: Use the agent/plugin package with OAuth dynamic registration, sideload and test in your Microsoft 365 tenant, then follow the eligible Partner Center publishing route.
• GitHub Copilot / VS Code: Use the VS Code MCP configuration and complete OAuth linking. This is a developer-client connection, not Microsoft 365 marketplace publication.

A working custom connection does not mean this connector has been accepted into a provider's public directory. Public listings require separate provider review. AI responses can contain mistakes; inspect records before acting.