# Mcp Creatio > MCP server for Creatio CRM. Connect ChatGPT, Claude, and GitHub Copilot to Creatio via Model Context Protocol (MCP) and OData v4. - **Type:** MCP server - **Install:** `agentstack add mcp-crackish-mcp-creatio` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [CRACKISH](https://agentstack.voostack.com/s/crackish) - **Installs:** 0 - **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [CRACKISH](https://github.com/CRACKISH) - **Source:** https://github.com/CRACKISH/mcp-creatio - **Website:** https://www.npmjs.com/package/mcp-creatio ## Install ```sh agentstack add mcp-crackish-mcp-creatio ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # MCP Creatio Server [](https://www.npmjs.com/package/mcp-creatio) [](https://hub.docker.com/r/crackish/mcp-creatio) [](LICENSE) Model Context Protocol (MCP) server for [Creatio](https://www.creatio.com/) — connect Claude Desktop, ChatGPT, GitHub Copilot, and other AI tools to your Creatio data, schema, and processes. > Also discoverable as: _Creatio MCP server_ · _MCP server for Creatio CRM_ · _Model Context > Protocol for Creatio_. --- ## Contents - [What it does](#what-it-does) - [Quick start](#quick-start) - [Authentication](#authentication) - [Configuration](#configuration) - [CRUD backend](#crud-backend) - [Tools](#tools) - [Docker](#docker) --- ## What it does - **CRUD + schema** — read, create, update, delete records; list entity sets; inspect schemas. - **Business processes** — run Creatio workflows with parameters. - **System settings** — read, write, and manage system-setting metadata. - **Feature toggles** — manage `Feature` / `AdminUnitFeatureState` and refresh the feature cache. ⚠️ Only DB-backed features are reachable (those defined solely in `web.config` are invisible). - **System operations** — manage `SysAdminOperation` and per-user/role grants (OData blocks these tables, so dedicated tools are provided). - **Custom services** — invoke any configuration-package REST service (`/0/rest//`) when no dedicated tool fits. - **Selectable data backend** — Creatio DataService (default) or OData v4 (`CREATIO_MCP_CRUD_BACKEND`). - **Optional semantic layers** — DataForge and Global Search tools auto-register when the instance supports them. Works with Claude Desktop, ChatGPT Connectors, GitHub Copilot, and any MCP-compatible client. --- ## Quick start The server runs in one of two transports. **Pick by how your client connects**, then pick an [authentication](#authentication) method. ### stdio (single-user, local) For clients that launch a command directly (VS Code MCP, Claude Desktop). Single Creatio identity per process; authenticate with **client credentials** or **legacy** login. ```bash npx -y mcp-creatio@latest \ --base-url https://your-creatio.com \ --login your_login --password your_password ``` ```jsonc // VS Code / Claude Desktop (command-based) { "creatio": { "command": "npx", "args": [ "-y", "mcp-creatio@latest", "--base-url", "https://your-creatio.com", "--login", "your_login", "--password", "your_password", ], }, } ``` > stdio logs are silent by default — enable with `--log-level info` or `CREATIO_MCP_LOG_LEVEL`. ### HTTP (multi-user, hosted) For clients that connect by URL, and for multi-user / hosted deployments. This transport serves the `broker`, `delegated`, and `gateway` auth modes (see [Authentication](#authentication)). ```bash npm start # serves http://localhost:3000/mcp ``` ```jsonc { "creatio": { "type": "http", "url": "http://localhost:3000/mcp" } } ``` --- ## Authentication One unified selector — `CREATIO_MCP_AUTH_MODE` — picks how a request proves its Creatio identity. When unset it is inferred from the credentials you provide. The HTTP modes are multi-user; stdio is single-user. | Mode | Transport | How identity is established | When to use | | ------------------------ | ------------ | ----------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | **`broker`** | HTTP | The MCP is its own OAuth server: it walks the user through Creatio login and holds their tokens | **Standalone direct clients** (Claude Desktop / ChatGPT) — connect → authorize → work as you | | **`delegated`** | HTTP | The client brings a Creatio token; the MCP validates expiry and passes it through | Clients that obtain a Creatio token themselves / behind an external AS | | **`gateway`** | HTTP | A trusted Control-Plane injects the token per request | Behind the Creatio.ai Control-Plane (multi-tenant) | | **`client_credentials`** | stdio / HTTP | One service account (`client_id` / `secret`) | M2M / single service identity | | **`legacy`** | stdio / HTTP | One user (login / password) | Local / legacy instances | > The MCP issues Creatio tokens of its own only in `broker` mode (where it must, to drive the > login). `delegated`/`gateway` pass tokens through; `client_credentials`/`legacy` use a single > server-side identity. > **Trust model.** `delegated` and `gateway` are **fully-trusted-environment** modes: the MCP does > NOT cryptographically verify the incoming Bearer — Creatio remains the authority and rejects bad > tokens on the API call — so the request's `userKey` is an unverified, logging-only identity. Run > them only where the caller is trusted (`gateway`: behind the Creatio.ai Control-Plane; > `delegated`: a trusted client on a trusted network / your own proxy). For an **untrusted direct > external client** that needs the MCP itself to verify identity, use `broker` — there the MCP > issues and verifies its own audience-bound (`aud`/`iss`) tokens. ### `broker` — the "connect & authorize" UX for direct clients The MCP acts as an OAuth 2.1 authorization server for its clients (dynamic registration, authorize, token) and brokers the actual login to Creatio via authorization_code with PKCE. The client only ever talks to the MCP, so this works even though Creatio offers no dynamic client registration — and the client never needs to reach Creatio's TLS endpoint directly. The tokens the MCP issues to clients are **audience-bound** (`aud` = this deployment's `/mcp` resource, `iss` = its origin), so a token minted by one deployment is rejected by another even when they share a secret. The MCP also supports the **`refresh_token` grant** (rotating), so a client gets a fresh access token without re-running the browser flow every hour — for as long as the MCP still holds that user's Creatio tokens. ```bash CREATIO_MCP_AUTH_MODE=broker CREATIO_CLIENT_ID=your_creatio_oauth_app_client_id # the Creatio "On behalf of a user" app CREATIO_MCP_JWT_SECRET=a-long-random-secret-min-32 # signs the tokens the MCP issues to clients # CREATIO_CLIENT_SECRET=... # only for a confidential Creatio app (omit for public/PKCE) ``` > **`CREATIO_MCP_JWT_SECRET`** must be **at least 32 characters** (HS256 security rests entirely on > its entropy — a shorter value is rejected at startup). In **production** (`NODE_ENV=production`) it > is **required** (the server fails closed if unset). Outside production an unset secret yields a > random one so a local run needs no setup — but the tokens the MCP issues are then invalidated on > every restart and are not valid across multiple instances, so **set a stable secret for production > or any horizontally-scaled deployment.** **Persistence / horizontal scaling (broker holds users' Creatio tokens).** By default those tokens live in-process — fine for a single instance, but lost on restart and not shared across replicas. For production set a **Redis** token store: tokens are encrypted at rest (AES-256-GCM) and survive restarts, so the broker becomes stateless and horizontally scalable. ```bash CREATIO_MCP_TOKEN_STORE=redis CREATIO_MCP_REDIS_URL=redis://your-redis:6379 # CREATIO_MCP_TOKEN_ENC_KEY=... # optional; encryption key, else derived from CREATIO_MCP_JWT_SECRET ``` **Logout / revocation.** The broker exposes an **RFC 7009** `POST /revoke` endpoint (advertised as `revocation_endpoint` in the AS metadata): presenting an issued token revokes the user's Creatio token upstream (`/connect/revocation`, best-effort) and purges the server-side Creatio tokens and issued refresh tokens. It always answers `200` (no token-validity oracle). Register the Creatio app in System Designer → _OAuth 2.0 applications_ → _On behalf of a user_, and add the MCP callback (`http://localhost:3000/oauth/callback` for a local run) to its redirect URIs. ### `delegated` (default when nothing else is set) Pure resource server: each `/mcp` request must carry a Creatio access token; the MCP advertises the authorization server (Creatio Identity) via **RFC 9728** and challenges unauthenticated requests, so the client logs in directly against Creatio. Needs no server-side credentials. The token is passed through unverified (Creatio is the authority) — a **trusted-environment** mode (see the trust note above). **What the client sends.** The MCP **client** attaches the Creatio access token as a Bearer header on every `/mcp` request. In a client that supports static headers: ```jsonc { "creatio": { "type": "http", "url": "http://localhost:3000/mcp", "headers": { "Authorization": "Bearer " }, }, } ``` Server side, just select the mode (no credentials needed): ```bash CREATIO_MCP_AUTH_MODE=delegated CREATIO_BASE_URL=https://your-creatio.com ``` A request with **no** `Authorization` header gets `401` with a `WWW-Authenticate` challenge pointing at Creatio Identity (RFC 9728), so a compliant client knows where to log in. > **Forwarding a Creatio session cookie instead of a Bearer.** A client that authenticated to Creatio > the classic way holds a **Forms-auth session** (cookie + `BPMCSRF`), not an OAuth token. It can > forward that session instead of a Bearer by sending the cookie in **`X-Creatio-Cookie`** (and, > optionally, the anti-forgery token in `X-Creatio-Bpmcsrf` — otherwise it is read from the cookie). > The MCP attaches `Cookie` + `BPMCSRF` + `ForceUseSession` statelessly and lets Creatio validate it. > `Authorization: Bearer` takes precedence when both are present. ### `gateway` A trusted fronting service (Creatio.ai Control-Plane) injects the credential; the MCP trusts and uses it. The optional `X-Creatio-Base-Url` header routes a request to a specific Creatio instance (multi-tenant) — honored only in this mode. Because that override decides where the request's credential is sent, it is validated: set **`CREATIO_MCP_ALLOWED_BASE_URLS`** (comma-separated origins) to restrict it to your tenants. When unset, any `http(s)` host is accepted (trusting the gateway) except the cloud-metadata link-local address, which is always blocked (SSRF guard). **Who sends what.** Unlike `delegated`, the end client talks to the **gateway**, not to the MCP — so the **gateway** is what injects the per-request headers. On each forwarded `/mcp` call it sends a Creatio credential — either a Bearer token, or a forwarded Forms-auth session: ```http POST /mcp HTTP/1.1 Authorization: Bearer # a Bearer token … X-Creatio-Cookie: BPMCSRF=; .ASPXAUTH= # … OR forward a Forms-auth session instead X-Creatio-Base-Url: https://tenant-a.creatio.com # optional — pick the tenant's instance (multi-tenant) ``` Server side: ```bash CREATIO_MCP_AUTH_MODE=gateway CREATIO_BASE_URL=https://default-creatio.com # fallback when no X-Creatio-Base-Url CREATIO_MCP_ALLOWED_BASE_URLS=https://tenant-a.creatio.com,https://tenant-b.creatio.com # SSRF allowlist ``` Smoke-test it directly with `curl` (mint a token out-of-band first): ```bash curl -sS http://localhost:3000/mcp \ -H "Authorization: Bearer $CREATIO_ACCESS_TOKEN" \ -H "X-Creatio-Base-Url: https://tenant-a.creatio.com" \ -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get-current-user-info","arguments":{}}}' ``` > **Bearer or session cookie — nothing else.** The gateway injects either a Creatio OAuth **Bearer** > token or a forwarded **Forms-auth session** (`X-Creatio-Cookie` + `BPMCSRF`); the MCP forwards it > statelessly (no cookie jar, no per-credential pool) and Creatio validates it. The gateway owns auth — > it should hold a ready Creatio credential of one of those two shapes. Other shapes (Basic, API key) > are intentionally out of scope. > **Per-tenant tool isolation.** A single MCP deployment serving many instances keeps each tenant's > tool surface separate, keyed by the effective base URL (`X-Creatio-Base-Url`, else `CREATIO_BASE_URL`). > Optional capabilities are **probed per tenant** and the tools they expose (DataForge, Global Search, > and any dynamically discovered per-instance tools) are registered only for the tenant they were > discovered on. Tenant A's tools or DataForge verdict never leak into tenant B's session, even though > both share one process. The > per-tenant state is pooled with idle-TTL + LRU eviction, so memory stays bounded as the number of > distinct instances grows. Single-tenant modes (everything except `gateway` with an override) all map > to one bucket, so their behavior is unchanged. ### `client_credentials` / `legacy` ```bash CREATIO_CLIENT_ID=your_client_id # client_credentials CREATIO_CLIENT_SECRET=your_client_secret CREATIO_LOGIN=YourLogin # legacy CREATIO_PASSWORD=YourPassword ``` > **Precedence:** an explicit `CREATIO_MCP_AUTH_MODE` always wins. When unset, the mode is inferred: > legacy (login+password) → client_credentials (id+secret) → delegated. `broker`, `delegated` and > `gateway` require HTTP transport (stdio has no incoming web request to authenticate). --- ## Configuration Grouped from essential to optional. **`CREATIO_BASE_URL` is the only always-required value** — nothing works without it; the rest depend on the auth method and the features you enable. ### Connection (required) | Variable | Description | | ------------------ | -------------------------------------------------------------------- | | `CREATIO_BASE_URL` | **Required.** Creatio instance URL (e.g. `https://your-creatio.com`) | ### Authentication (pick one method — see [Authentication](#authentication)) | Variable | Mode | Description | | ------------------------------------ | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `CREATIO_MCP_AUTH_MODE` | any | `broker` \| `delegated` \| `gateway` \| `client_credentials` \| `legacy`. Unset ⇒ inferred (legacy → client_credentials → delegated) | | `CREATIO_CLIENT_ID` | broker / M2M | Creatio OAuth app client id (the brokered app, or the M2M account) | | `CREATIO_CLIENT_SECRET` | broker? / M2M | Required for client_credentials; optional for a confidential broker app (omit for public/PKCE) | | `CREATIO_MCP_JWT_SECRET` | broker | Secret signing the tokens the MCP issues to clients. **Min 32 chars; required in production.** Random if unset outside prod (set a stable value for prod / multi-instance) | | `CREATIO_MCP_ALLOWED_BASE_URLS` | gateway | _Optional_ — comma-separated allowlist of Creatio origins the `X-Creatio-Base-Url` override may target (SSRF guard). Unset ⇒ any http(s) host except … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [CRACKISH](https://github.com/CRACKISH) - **Source:** [CRACKISH/mcp-creatio](https://github.com/CRACKISH/mcp-creatio) - **License:** MIT - **Homepage:** https://www.npmjs.com/package/mcp-creatio Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-crackish-mcp-creatio - Seller: https://agentstack.voostack.com/s/crackish - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.