Turning MCP on

Four separate things must all be true before an assistant returns data. Check them in this order, because the first failure is almost always the answer.

1. Your firm’s MCP / API module#

This is the switch above everything else, and it is set by Modero on your partner record rather than by you. If it is off, none of your client organizations are reachable over MCP no matter what their own plans say. To have it enabled, contact Modero support.

2 and 3. The client organization’s entitlements#

mcp_access lets that organization’s users read their data through an assistant. api_write lets them change it. They are set on the client’s plan, the same place as the other add-ons and entitlements.

Grant them separately and deliberately. A client that only wants to ask questions should have mcp_access without api_write: reads work, and every write is refused at the platform, regardless of what the user’s role would otherwise allow.

Note the difference between the two refusals a user can hit here:

• mcp access is not enabled on the plan. The entitlement is missing. You fix it.
• <entity> is not available at your access level. The entitlement is fine, but the user is reaching for data on a plane their role does not cover. That needs a role change, not a plan change.

4. The AI client#

Claude, ChatGPT, and Gemini are on the vendor allowlist and register without a human. Locally-run tools that use a 127.0.0.1 callback are also approved automatically.

Anything else registers successfully and is then held for review. The user is redirected to a page naming the client, and a Modero platform admin approves it. If one of your clients wants to use a tool outside the big three, send Modero the client’s name before they set it up.

The review exists because the consent screen shows a raw client ID and no vendor name, so a user genuinely cannot judge where their data would go. Someone who can see the client’s redirect URIs can. Treat “pending approval” as the system working.

CRM tools need the CRM module#

The CRM record types (companies, contacts, deals, tasks, notes, quotes, pipeline stages) live on the partner plane. They are reachable over MCP only when your firm’s CRM module is on, and only by partner staff. A client organization user never sees them.

The two refusals again look similar and mean different things:

Common questions#

Can I turn MCP on for one client and not another? Yes. mcp_access and api_write are per-organization entitlements. The partner-level MCP / API module is the ceiling above them: it has to be on for any of your clients to use MCP at all.

A client’s lists come back empty for everything. Where do I start? The partner module, requirement 1 above. Empty results for every entity, rather than a refusal on one, is the signature of the partner switch being off or the user having no memberships.