MCP Server: talk to your CRM from any AI assistant

The MCP Server exposes 68 tools that let an AI assistant read, create and update records across 13 areas of CrmLeaf - from leads, deals and invoices to projects, tasks and time logs. The assistant calls a named tool with typed parameters; the server translates that into a CrmLeaf request made as you. Lists return up to 100 records at a time, newest first, and the assistant can ask for the next page.

Alongside the tools, 25 reference resources expose the lists an assistant needs to fill fields correctly: lead sources, deal pipelines and stages, project and task statuses, categories and labels, the people a task can be assigned to, and units of measure. Vendors, purchase orders, bills and payments need the Purchase add-on; budgets need the Budget add-on.

• Leads
• Deals
• Invoices
• Projects
• Tasks
• Time Logs
• Products
• Customers
• Vendors
• Purchase Orders
• Bills
• Payments
• Budgets

The MCP Server has no delete tools. An assistant can read your data, create new records and update existing ones - but it cannot remove a lead, a deal or a project. This is a design decision, not a limitation: it prevents accidental data loss when an assistant acts on an ambiguous instruction.

Every write is also re-checked against your own add or edit permission, so a read-write connection never goes further than you could in the web app. A few things stay in the web interface on purpose: deleting anything, running timers (an assistant logs a finished time entry instead), task files and notes, tax rows, recurring invoices, and turning time or expenses into an invoice.

• Read - always
• Create - read-write connection
• Update - read-write connection
• Delete - never

CrmLeaf's MCP Server works with Claude.ai, Claude Desktop, Claude Code, Cursor and VS Code - and with any other client that supports remote MCP servers over HTTP. Every client uses the same server address, https://mcp.crmleaf.com/mcp, for every account; there is no per-account URL to look up.

The server is a stateless translation layer. It holds none of your records and keeps no copies: each request is made to CrmLeaf as you, and the client keeps the conversation context.

• Claude.ai
• Claude Desktop
• Claude Code
• Cursor
• VS Code
• Any remote MCP client

The recommended route is to sign in: add the server address to your assistant and log in with your CrmLeaf account when it asks. This uses OAuth 2.1 with PKCE, and assistants register themselves automatically - there is no token to copy or store. A connection made by signing in can read and write, always within your own permissions.

The alternative is a personal access token, created under Profile → Access Tokens and sent as a bearer token. Use one when your assistant cannot sign in interactively, or when you want a read-only connection. Tokens are read-only by default, last 30 days, and are pinned to the company and organisation they were created in.

• OAuth 2.1 + PKCE
• Personal access tokens
• Read-only by default
• Read-write on request
• 30-day token expiry
• Pinned to one workspace

Every change an assistant makes - create, update, send or pay - is recorded in an audit trail: who acted, which token or connection was used, the action, the record, the outcome and the names of the fields submitted. The values themselves are never captured, and looking records up is not audited.

Changes made through MCP are ordinary record changes, so your workflow automation rules fire on them exactly as they would on an edit in the web app, the mobile app or the API.

• Writes audited
• User & connection
• Record & outcome
• Field names only
• Automation rules fire