AI Connector (MCP)
Connect your Paloma365 account to AI assistants (Claude and others) over the MCP protocol. By default the assistant is read-only; anything it may change you grant with checkboxes when creating the connection.
How to Access
Settings → AI Connector (MCP) (/settings/mcp-connector).
Overview
The AI assistant gets access to your account data: searching and viewing items and reference lists, and — if you allow it — creating documents, posting them, reports and settings. Access is granted as your employee and with your permissions — the assistant cannot do more than you can.
Fields
| Field | Description | Required |
|---|---|---|
| Name | A label to tell tokens apart (e.g. "Claude Desktop — laptop") | No |
| Lifetime | How many days the token is valid: 30, 90, or 365 | Yes |
| What the connector may do | Checkboxes for extra permissions (see below). Nothing is ticked by default | No |
What the Connector May Do
Reading is always granted and needs no checkbox. Everything else is a separate consent:
| Permission | What it opens |
|---|---|
| Create and edit | Editing items and creating document drafts. Reversible |
| Document posting | Posting a document: changes stock levels and cost price. Irreversible |
| Account setup | Trade points, workplaces, employees with logins and passwords, rooms, tables, roles, warehouses |
| Reports | Read-only: stock on hand, cash and bank balances, sales |
| View settings | Safe application settings (appearance, receipt, shift, delivery, region) |
| Edit settings | Editing one such setting. Includes viewing |
Permissions are fixed at the moment the connection is created and never change afterwards. To add a right, revoke the token and create a new one — otherwise the assistant will keep answering "tool unavailable".
Step-by-Step Guide
- Open the AI Connector (MCP) page.
- Enter a name and lifetime, tick the permissions you need, then click Create connection.
- Copy the displayed access token — it is shown only once.
- Pick your client:
- Claude Code — run the displayed command in your terminal.
- Claude Desktop — add the displayed block to your
claude_desktop_config.jsonand restart the app.
- The MCP server URL is already filled into the command/config.
Managing Tokens
The Active tokens table shows each token's name, permissions, creation date, last use, expiry, and status. Any token can be Revoked — the connection stops working immediately. The Revoke all button revokes every token at once.
The Permissions column shows exactly what was ticked when the connection was made: "Read", "Create and edit", "Post documents", "Account setup", "Reports", "View settings", "Edit settings". Permissions are granted once, at connection time, and never change afterwards. If a permission is missing from the list, the assistant simply cannot do that on this connection: revoke the token and connect again, ticking the consent you need.
Tips
- Treat the token like a password: never publish it or store it in shared repositories.
- If a token is compromised, revoke it and create a new one.
- The token inherits your permissions, so only connect trusted apps.
FAQ
Q: Can I connect ChatGPT or claude.ai (web)?
A: Yes — they connect as an OAuth connector: a consent screen opens where you tick what you allow. They do not need a token from this page; that token is for Claude Code and Claude Desktop. Whatever such a connection was granted is then visible in the Permissions column.
Q: Can the assistant change items or prices?
A: Only if you ticked that at connection time — the "Create and edit" checkbox on this page, or the same one on the consent screen of an OAuth connection. Without it the assistant creates and changes nothing, and without "Document posting" it posts nothing. What was actually granted is visible in the Permissions column.
Q: The assistant says a tool is unavailable, although it used to work
A: Two common causes, both visible on this page. First — the connection lacks the permission: check the Permissions column and, if the one you need is missing, reconnect the connector and tick that consent. Second — the assistant is working from an old skill list: start a new chat (in an old one the skill list is frozen from when it was created). What the assistant actually called and how it ended is visible on the MCP log page.
Q: What happens when the token expires?
A: The connection stops working. Create a new token on the same page.