MCP access

The MCP server lets Claude, or another MCP client, read and change the CRM on your behalf. Each access acts with your rights in the CRM, limited to the permissions you grant it, and can be revoked at any time.

All plans Settings › Integrations › MCP access Every member, for their own accesses (not Support seats)

12345

1. 1Server URL
2. 2Create a token
3. 3A personal token
4. 4Connected applications
5. 5Log

Hover a number to locate the area. Click the screenshot to enlarge it.

Close

Connect claude.ai or Claude Desktop

1. Copy the Server URL shown at the top of the page.
2. In claude.ai or Claude Desktop, open Settings › Connectors and add a custom connector with that URL. These menu names belong to Claude and may change.
3. Sign in to the CRM when Claude sends you there. The consent page shows the application and the permissions it asks for; only read is ticked by default.
4. Click Allow. Claude appears under Connected applications.

Any other client that supports OAuth works the same way. Clients that don’t support OAuth (scripts, for example) use a personal token.

Create a personal token

Close

1. Click Create a token and give it a name that says where it is used.
2. Tick the permissions needed, and only those:
   • CRM read: records, searches, history.
   • CRM write: create, edit and archive records. It doesn’t include read: tick both for everyday use.
   • Automation editing: create and edit workflows, without activating them.
   • Automation activation and Administration are reserved for platform administrators: they stay greyed out for organization accounts.
3. Choose the expiration: 30 days, 90 days, 1 year, a date, or no expiration.
4. Click Create token, then copy it right away.

The token is shown only once

Keep it like a password. The CRM only stores its fingerprint: if it’s lost, revoke it and create another. The client sends it in the Authorization: Bearer <token> header.

Revoke an access

Revoke cuts off a token or a connected application immediately: the client loses access on its next request. Revoking an application removes all its authorizations; you can reconnect it from its own settings. Expired and revoked tokens stay listed; Show revoked tokens expands them.

The log

The Log lists recent tool calls: the date, the client, the tool called and the result (Success, Error, Denied or Confirmation requested). Load more goes further back.

What an MCP client can do

• It only sees what you see: your rights in the organization apply, on top of the token’s permissions. A Viewer only gets the reading tools.
• Archiving a record asks for your confirmation: the client asks you, or shows you a preview before acting. Permanent deletion stays in the CRM.
• Record and e-mail content reaches it as untrusted data, never as instructions. It can still contain malicious instructions: check the actions the client offers to take.
• Each token has a per-minute limit: 120 reads, 30 writes and 10 high-impact actions.

Atlas, inside the CRM

Atlas, the CRM’s assistant, uses the same tools as MCP clients, with your rights. It needs no token: open it with the Atlas button at the top of the screen (see Talk to Atlas).