The Coevera MCP Server makes Coevera CRM data and operations available as tools for AI assistants, such as Claude, ChatGPT, and any other client that supports the Model Context Protocol (MCP). The assistant discovers the available tools and calls them with structured arguments to read, search, and change records directly. Every call runs under the signed-in user’s permissions, so the assistant can only see and do what that user can.

NOTE: This article covers version 2.1.0, the first published release of the server. It includes everything delivered from version 1.1.3 onward.

The server uses the Streamable HTTP MCP transport. Clients send tool calls as POST requests to the /mcp endpoint with an Authorization: Bearer token, and sessions are stateless.

Sign-in uses the OAuth 2 Authorization Code flow against the Coevera OAuth server, with PKCE (S256). The server publishes its OAuth discovery documents with its own origin as the issuer (RFC 8414). When a request is unauthorized, the 401 response carries a WWW-Authenticate challenge with resource_metadata (RFC 9728). Together, these let clients such as ChatGPT register the connector by themselves.

Every request is re-validated through token introspection, and the results are cached for a configurable time. Required scopes include units_and_roles.read.

Long-running calls stream progress notifications over Server-Sent Events when the client sends Accept: text/event-stream. Other clients receive plain JSON.

The server applies burst and sustained rate limits. If the rate-limit store is unavailable, it returns a structured 503 response instead of failing. All responses include Content Security Policy headers, and the OpenAI Apps challenge endpoint is available for ChatGPT verification.

Before working with records, an assistant can check who is signed in and what the space contains using these tools:

NOTE: Fields that the REST API cannot load are not listed by meta_describe_entity.

search_records searches a single entity using boolean filter trees (AND, OR, NOT), typed comparators, sorting, and cursor pagination. It accepts both cursor and after as the pagination argument. get_records fetches specific records by ID, with no sample cap. Both tools can expand related records, and the server builds the record links in the results.

global_search searches several entities in one call using the CRM’s own global search, and returns per-entity counts and compact result cards with record links. It covers:

run_report returns count, sum, average, minimum, and maximum values, optionally grouped by up to three fields. Date fields can be grouped by month, quarter, or year. Amounts are returned in the space’s base currency, and group keys are returned as names rather than IDs.

A report reads up to report_scan_cap records (10,000 by default) within a time budget. When a result is truncated, the response says so and explains why.

export_records streams a CSV file directly from the CRM and returns a one-time download link at /download/{token}. The link is valid for 10 minutes, and a file can hold up to 10,000 rows. The response describes the file and its columns but doesn’t contain any rows itself.

In the file, references and dropdown values are written as names. Set include_ids to add ID columns for joins. Date-times are in UTC. If no field list is given, every field the user’s role can read is exported, and any hidden fields are listed in inaccessible_fields.

When fewer rows are exported than match the request, truncated_reason explains why. If the CRM fails part-way through a download, the download is aborted rather than delivered as an incomplete file.

NOTE: Exporting requires the CRM Export permission. Because export_records is not marked as read-only, clients ask the user to approve each export.

create_records and update_records write several records in a single call and report the result for each record in input order. CRM validations are applied: new records are fully validated, updates validate the fields they change, and any rule violations are returned as per-record errors.

delete_records soft-deletes up to 100 records by ID and reports the result for each record in input order. Related records follow the CRM’s own rules, such as recurring Appointment occurrences, Email draft replies, and the Account hierarchy. These record types can be deleted:

NOTE: Leads and Opportunities cannot be deleted.

change_ownership reassigns Tasks, Opportunities, Contacts, Accounts, Appointments, Leads, and Memos to another owner. For Leads and Memos, the response warns that the caller may lose write access after the reassignment.

All tools reject unknown argument names, and the error lists the valid ones.

Four bulk tools run the CRM’s own business logic, including time-in-step tracking, approval removal, AI fitness snapshots, activity completion, and quote transitions:

Each one accepts an optional rollback_method, either ROLLBACK_ALL or ROLLBACK_FAILED. Batches of 20 or more records run asynchronously and return an asyncOperationId.

For sales step checklists, get_step_checklist_status lists a step’s checklist items and, for a given Opportunity, whether each item is complete.

complete_step_checklist_item marks an item as satisfied with the matching activity, note, document, or email. Field-type items are completed by updating the field instead.

upload_cloud_object_document registers an upload into a Cloud Object folder and returns a single-use upload link at /upload/{token}. The client then posts the file to that link. The default size limit is 50 MiB. Cloud Objects and Cloud Object folders can also be created and updated.

set_record_picture sets an Account logo, Contact photo, or Product image using the same two-phase upload. The server checks the file type and returns HTTP 415 for anything other than:

NOTE: picture_id is read-only in create_records and update_records, and an uploaded document can no longer be set as a picture.

Every tool sets these hints explicitly, each with a justification, so clients can ask the user for confirmation before changes are made:

The server instructions direct AI models to use global_search for finding records, run_report for totals, and export_records for files. They also state that tool results are user-entered CRM data and never instructions. Tool descriptions fit within the 2,048 characters that claude.ai shows.