MCP Server¶

The MCP Server lets compatible clients use EspoCRM tools through the Model Context Protocol over Streamable HTTP.

Every request authenticates as an EspoCRM user. The client receives only the tools and data that user is allowed to use.

Enable the server¶

Open Administration > Integrations > MCP Server.
Enable the integration.
Save.
Copy the endpoint and the configuration example for your client.

The endpoint is:

https://your-crm.example/api/v1/EblaAi/message

Authentication¶

Use one of these request headers:

Method	Header
Basic authentication	`Authorization: Basic BASE64_TOKEN`
EspoCRM authentication	`Espo-Authorization: BASE64_TOKEN`
API User	`X-Api-Key: API_KEY`

Warning

Credentials in the URL are not supported. Do not place usernames, passwords, tokens, or API keys in query parameters.

For automation, create a dedicated API User or least-privilege user instead of using an administrator account.

Client example¶

{
    "mcpServers": {
        "EspoCRM": {
            "type": "http",
            "url": "https://your-crm.example/api/v1/EblaAi/message",
            "headers": {
                "Authorization": "Basic BASE64_TOKEN"
            }
        }
    }
}

The settings page provides client-specific examples for supported MCP clients.

Permissions and confirmation¶

MCP tools still enforce:

AI and feature permissions
Scope and record access
Field-level security
Relationship, stream, and mass-action permissions
Administrator checks for administrative tools

Changes that require approval are not made solely because a model requested them.

Troubleshooting¶

Unauthorized¶

Confirm the header name and credential value. For API Users, use X-Api-Key. Do not move credentials into the URL.

Server disabled¶

Enable and save the MCP Server integration.

A tool or record is missing¶

Check the connecting user's Roles, Teams, field-level security, and API User access.

A change is refused¶

The user may lack the required create, edit, delete, relationship, stream, mass-action, or administrator permission.