MCP Server (connect AI agents)
Connect AI agents to Core over the Model Context Protocol — permission-scoped, workspace-isolated, with optional write access.
MCP Server
Experimental — the MCP server is in beta. Behavior may change as we refine the connect experience.
Core exposes a Model Context Protocol (MCP) server so AI agents — Claude, Cursor, ChatGPT, or your own — can work with Core as you. Every request uses your existing Core permissions and stays in one workspace. You choose read-only or read-and-write access when connecting.
Quickest available setup: open core-it.tools/mcp and choose your AI tool. The page opens the install flow for Cursor and VS Code, provides a command for Claude Code, and keeps the URL beside guided steps for Claude and ChatGPT. No tokens to paste.
The connect page and the endpoint are different URLs.
core-it.tools/mcpis a page you open in a browser. The endpoint you paste into an MCP client ishttps://core-it.tools/api/mcp. Pasting the connect page into a client fails during sign-in — see Troubleshooting.
What an agent can do
The agent gets tools filtered by your effective workspace permissions:
| Area | Examples |
|---|---|
| Tickets | Search and retrieve tickets, messages, checklists, SLA status, time entries, attention queues, and ticket analytics |
| Companies and assets | Find companies, contacts, assets, company health, and customer asset lists |
| Projects and contracts | Review projects, tasks, resourcing, contracts, renewals, billing summaries, and actual hours |
| Financials and capacity | Review forecasts, targets, revenue, opportunities, capacity, availability, resource plans, and headcount forecasts |
| Operations | Review schedules, onsite visits, dispatch, team information, automations, reports, activity, notifications, and meetings |
| Knowledge | Search knowledge-base articles and documents |
| Discovery | Search across Core, list tags, and identify the connected user and workspace |
Sensitive discovery, financial, resourcing, roster, project, contract, automation, and reporting tools are shown only when the connected user has the permissions they require. Everything still follows what you can already see or do in Core.
With read-and-write access, selected create, update, delete, and action tools are also available when your Core permissions allow them. Every write is bounded and idempotent, is recorded in an immutable mutation ledger, and runs through the same tenant-pinned data policies. Own-only, low-impact changes may run automatically; higher-impact actions return a short-lived Core approval link before execution. The link contains a non-secret approval ID; Core keeps the execution secret server-side. Unsupported or human-only workflows stay hidden or return an explicit handoff instead of silently approximating the UI workflow.
Connecting an agent
The guided path is the connect page — choose your tool and follow its setup steps. If you'd rather wire it up by hand, the endpoint is all you need:
- In your MCP client, add the Core MCP endpoint:
https://core-it.tools/api/mcp. Use that exact path —/api/mcp, not/mcp. - When prompted, sign in to Core, choose a workspace, and select Read only or Read and write.
- That's it — you never copy or paste a token.
There is no package to install — Core is a remote MCP server, so clients discover the login flow from the URL alone. (An unrelated open-source project called "IT Tools" ships an it-tools-mcp package; that is not Core — ignore it and use the URL above.)
Example prompt for an agent:
Connect to the Core MCP server at
https://core-it.tools/api/mcp. Use the server's browser login/approval flow; do not ask me to paste tokens into chat.
Workspace pinning
When you approve, the connection is pinned to the workspace you chose. If you later switch workspaces inside Core, the agent keeps seeing the workspace it was connected to — it does not follow your active workspace. To connect an agent to a different workspace, revoke it and reconnect.
Managing & revoking
Go to Settings → Agents to see every agent you've connected, its access level, and when it was last used. You can immediately downgrade a write-enabled connection to read-only or revoke it. To add write access to an existing read-only connection, revoke it and reconnect through the agent's OAuth flow.
Security model
- Runs as you. The agent sees only what you can see in Core. If you can't open a ticket, neither can the agent.
- Explicit write consent. Existing and read-only connections cannot mutate data. Write tools appear only after you approve read-and-write access, and your normal permissions still apply.
- Workspace-bound. Access stays on the workspace you approved at connect time.
- Suspension-aware. If your account is disabled or the workspace is suspended, the agent is blocked immediately.
- Bounded and replay-safe. Writes have hard scope caps and require a stable idempotency key so retries do not duplicate the action.
- Risk-tiered. Low-risk, own-only actions with exact concurrency checks (currently notification read/archive state) can run automatically. Higher-impact writes require a short-lived, same-user approval in Core bound to the exact connection, tool, and request.
- Audited. Core records tool activity and immutable mutation outcomes so connections can be reviewed. You can revoke any connection at any time from Settings → Agents.
Current coverage
Core exposes only workflows that have a bounded, permission-aware implementation. A read-and-write connection does not imply that every Core screen is currently agent-operable. If a workflow is not yet supported, the agent should say so and link you to the exact Core screen instead of approximating the change.
Coverage is tracked per feature and tested against the UI's underlying command or query. Because the MCP server is experimental, check the tool list reported by your connected agent for the current set of available actions.
Rate limits
To keep the service reliable, agent requests are limited per connection and per network. If an agent hits the limit, it should wait briefly and try again.
Troubleshooting
"Couldn't register with Core's sign-in service" (or a similar registration error when adding a custom connector)
Almost always the wrong URL. Check that the connector points at https://core-it.tools/api/mcp and not https://core-it.tools/mcp.
The connect page has no MCP endpoint behind it, so a client pointed there finds no sign-in metadata, falls back to guessing a registration address on the domain, and reports a registration failure. The real cause is two steps earlier than the message suggests.
"Authorization with Core failed" right after you approved the consent screen
If you already approved a workspace and access level, the connection usually exists — the error is often a stale message from an earlier failed attempt in the same session. Reopen the connector (or start a new chat) and check whether tools are listed. You can confirm from Core's side in Settings → Agents: an entry with the right workspace and access level means the connection completed.
If no entry appears there, the approval did not finish. Reconnect and complete the consent screen.
"This connector has no tools available"
- Confirm the connection is listed in Settings → Agents. If it is not, reconnect.
- Tool visibility follows your permissions. If your Core account has a narrow role, the agent sees a correspondingly narrow tool set.
- Tools are listed in pages. A client that does not follow pagination shows only the first page.
Each reconnect creates a new connection
Some clients register a fresh OAuth identity every time you connect (dynamic client registration), so each attempt is a new row rather than an update of the previous one.
Core cleans up abandoned attempts automatically:
- On a successful reconnect to the same workspace, never-used prior attempts for the same agent product are retired.
- Unused connections older than 7 days, and connections idle for 90 days, are expired by a daily cleanup job.
Previously used connections that still matter stay until idle expiry or you revoke them. Check Settings → Agents for leftover entries (including any that say Finish revoking) and revoke what you no longer need.