TMBefore you start
You need all of the following:
- An Enterprise organisation with MCP access enabled.
- An active Consuite user who belongs to that organisation.
- A client that supports remote MCP over Streamable HTTP and OAuth discovery.
- The organisation domain shown in its Consuite URL.
Owners and administrators control whether MCP is enabled. They can also force all connections into read-only mode. A user cannot grant more access than their role already has.
Use the organisation-specific endpoint
Replace YOUR-ORG-DOMAIN with the first path segment used when you open the organisation in Consuite. Each organisation gets a distinct connector URL.
https://consuite.app/api/mcp/YOUR-ORG-DOMAIN/mcpUse this endpoint rather than the unscoped fallback. It keeps each organisation clearly separated in the client and carries the correct organisation through OAuth consent.
Enable MCP for the organisation
- Open the organisation settings in Consuite.
- Select MCP Settings.
- Turn on Enable MCP Connections.
- Turn on Restrict to read-only if clients should not change records.
Turning MCP off blocks all access for that organisation. Turning read-only on removes write scope from new tokens and from existing connections on their next request.
Copy the endpoint
Open Consuite AI and choose Connect AI, or open your account's AI settings. Copy the MCP endpoint shown for the current organisation.
The copied value should end in /api/mcp/<organisation-domain>/mcp.
Add Consuite to the client
Add Consuite as a remote MCP server. The client must use Streamable HTTP and support the browser-based OAuth flow advertised by the endpoint.
Claude Code
claude mcp add consuite-YOUR-ORG-DOMAIN --transport http "https://consuite.app/api/mcp/YOUR-ORG-DOMAIN/mcp"Cursor
Add the following server to your MCP configuration file:
{
"mcpServers": {
"consuite-YOUR-ORG-DOMAIN": {
"url": "https://consuite.app/api/mcp/YOUR-ORG-DOMAIN/mcp"
}
}
}Other compatible clients
Create a custom remote MCP connection and paste the endpoint. Product labels differ between clients, but the server URL and OAuth discovery flow remain the same.
Sign in and approve access
The client opens Consuite in your browser. Sign in, select the intended organisation and review the requested scopes before approving the connection.
Search and inspect records available to your role and enabled features.
Create or update supported records when your role and organisation policy allow it.
External client, supplier and guest roles remain restricted. Organisation feature settings also remove tools that are not enabled for that organisation.
Verify and manage the connection
Start with a read-only check:
Identify the Consuite organisation you are connected to, then list my five most recently updated projects.
Confirm the returned organisation before asking the client to make bulk changes. Active clients appear under Connected apps in the account AI settings. Revoke any connection you no longer use or do not recognise.
What Consuite enforces
Organisation binding
The organisation comes from the verified token and is injected server-side.
Live permission checks
Scopes, membership, role, read-only policy and feature access are checked again on requests.
- Transport rate limit
- 60 requests per minute per access token
- Authorisation code lifetime
- 10 minutes
- Client registration
- Dynamic registration with approved redirect URI rules
- Connection removal
- Self-service revocation from Connected apps
Troubleshooting
The browser does not open for sign-in
Confirm the client supports remote MCP OAuth discovery. A client that only accepts local command servers cannot complete this flow.
The connection returns 401 or 403
Sign in with an active member of the intended organisation. Confirm MCP is enabled and reconnect the client if the token was revoked.
Write tools are missing
The organisation may be read-only, your role may not permit writes, or the relevant Consuite feature may not be enabled.
The client reports too many requests
Pause and retry after the delay in the response. The MCP transport allows 60 requests per minute for each access token.
The client asks for an SSE endpoint
Choose Streamable HTTP. The Consuite MCP endpoint accepts tool calls over HTTP POST and does not expose a legacy SSE notification stream.