MCP Server

MCP Server

The Magic Suite MCP Server lets AI assistants work with your Magic Suite data directly. It implements the Model Context Protocol (MCP), the open standard that AI clients such as Claude, GitHub Copilot, OpenAI Codex and Cursor use to connect to external systems.

Once connected, an assistant can answer questions about your Magic Suite configuration, and make changes to it, without you having to copy data back and forth.

What it can do

The server exposes the Magic Suite API as a set of tools the assistant can call. Today that means full OData access - reading, creating, updating and deleting any entity the API exposes. See Toolsets for the detail.

Permissions

This is the most important thing to understand about the MCP Server: it grants no access of its own.

You authenticate to it with a Magic Suite API Token. Every action the assistant takes is then performed against the Magic Suite API as the user who owns that token. The same tenant scoping, the same role-based access control and the same per-entity rules apply as they would if you had used the web interface, the CLI or the REST API directly.

In practice this means:

• An assistant can never see or change anything the token's owner could not see or change themselves.
• Revoking or regenerating the API Token immediately revokes the assistant's access.
• To limit what an assistant can do, limit the rights of the user whose token you use. Creating a dedicated, restricted user for AI access is a good practice.

Note that the assistant can still see the full list of tools even where it lacks the rights to use them; the call simply fails with a permission error. Tool visibility is not a security boundary - the API's permission model is.

Things to be aware of

The write tools (create, update and delete) act on live data. An AI assistant can misunderstand an instruction, so:

• Prefer a token belonging to a read-only or narrowly-scoped user when you only need the assistant to answer questions.
• Ask your MCP client to confirm tool calls before running them. Most clients can be configured to prompt before each call.
• Deletions cannot be undone.

Getting started

See Integrating with the Magic Suite MCP Server for connection instructions.