Connect Claude to your account — on a leash

It acts as you, and never more

An owner gets owner reach. A front-desk agent gets front-desk reach. A doctor gets clinic tools scoped to their own patients. A viewer is read-only at every configuration, no matter what they switch on. The MCP session runs as a real user, so every database policy behaves exactly the way it does when that person is clicking around the dashboard — the guarantee is not a check we remembered to write, it is the same mechanism the app already runs on.

• checkFive layers must all pass before a tool is even offered
• checkFour of them decide what the model may ask for
• checkThe fifth — the database — decides what it may actually see

Read-only until you say otherwise

A brand-new connection has the read tools on and everything that writes off. From there every tool is individually switchable, so you can grant exactly the job you want done and nothing adjacent to it. Tools above your role are shown disabled with the reason given — a ceiling you might one day cross is worth seeing. Tools outside your job are not shown at all, because a whole side of the business that isn't your work is just noise.

Some things are never on the menu

Account deletion, ownership transfer, changing who is a member or what role they hold, and anything touching credentials — API keys, other MCP connections, AI provider keys, channel configuration. These are unavailable at every configuration, including to an owner. They are either irreversible, or they are changes to authority rather than to business data, and a model steered by text that someone else wrote into a conversation must not be able to reach them.

A log that answers 'who', not 'what they said'

Every call records which connection, which person, which tool, the outcome, and the role it ran as — plus a redacted summary of the arguments built from a per-tool whitelist. Message bodies, notes, phone numbers, emails and clinical values are never stored; a text argument is recorded only as its length. The log answers who read or changed what, and when. It deliberately cannot answer what it said.

Set up in about a minute

Create a named connection, choose its toolset, and paste the URL into your client. The URL is shown exactly once and only a short prefix is kept afterwards, so nobody — including us — can recover it later. Expiry is mandatory, ninety days by default, and regenerating kills the old URL the moment you confirm.