The MCP server
LiveCRM is an MCP server as well as a product. Point your agent at it and it can ask anything about your CRM for nothing, and change nothing without a grant you issued.
The gap this closes. An agent handed a CRM API key has everything or nothing. The credential that lets it read your pipeline is the same credential that lets it delete your pipeline, so the only careful answer has been to not connect it at all.
Connect it
The connector is open to LiveCRM accounts. If you have one, sign in and add it. If your company is new to LiveCRM, start a free trial. If it already uses LiveCRM and you do not have access yet, ask an admin for an invite.
MCP server URL
Paste this into your client's connector field. It is not a page to open. Note the api. subdomain: this page is livecrm.ai/mcp, the server is api.livecrm.ai/mcp, and the two are not interchangeable.
claude mcp add --transport http --scope user livecrm https://api.livecrm.ai/mcpThen run /mcp inside Claude Code and choose LiveCRM to sign in. Leave out --scope user to add it to the current project only.
Add this to ~/.cursor/mcp.json to use it everywhere, or to .cursor/mcp.json in a project:
{
"mcpServers": {
"livecrm": {
"url": "https://api.livecrm.ai/mcp"
}
}
}Run MCP: Add Server, choose HTTP, and paste the server URL. Or add this to .vscode/mcp.json:
{
"servers": {
"livecrm": {
"type": "http",
"url": "https://api.livecrm.ai/mcp"
}
}
}Turn on developer mode in Settings, then add a connector with the server URL and OAuth sign-in. Which plans can do this, and where the setting sits, changes often, so check OpenAI's help pages if your menus look different.
Any client that supports remote MCP servers over streamable HTTP with OAuth connects with the server URL alone.
Approving sends you to a consent screen naming the client, your workspace and the account you signed in as, listing the capabilities it is asking for; those are the fourteen permissions set out further down this page.
That URL is this hosted deployment. A customer hosted deployment serves its own, because the issuer and the audience a token is minted for both derive from that deployment's own base URL, and a token issued by one cannot be replayed against another.
Sixty-seven tools, each one a call your agent can make against your own CRM. 37 of them only read.
Every tool declares what it does to the world. Whether it only reads, whether it destroys something, and whether it leaves this deployment at all. Those are not documentation: they are set per tool and required when the tool is defined, so a client can decide what needs confirming before it calls anything.
Capabilities, not read and write. Two values answer none of the questions an administrator actually has. May this agent create a run but not dispatch it. May it enrich but not merge. May it read the audit trail but not the records. Those are the questions, and they need a vocabulary with more than two words in it.
The division
The split is not a convention the server follows. It is declared per tool and enforced at the token.
They answer from this deployment's own mirror of your CRM. Free, immediate, and impossible to regret.
crm:readcount_crm_recordsget_crm_recordlist_crm_connectionslist_crm_userslist_filterable_fieldsruns:readget_data_healthget_operational_healthget_planget_readiness_recommendationsget_readiness_scanget_runget_run_recordsget_usage_summarylist_employer_changeslist_planslist_runslist_search_criteriapreview_plan_reversalruns:previewpreview_enrichment_runpreview_records_runtemplates:readget_assignment_configget_default_rule_configget_market_whitespaceget_normalize_catalogget_persona_whitespaceget_rule_templateget_tamget_tam_outwardlist_rule_templateslist_whitespace_companiespreview_normalize_schemededup:readget_duplicate_grouplist_duplicate_groupsaudit:readget_audit_event_recordslist_audit_eventsqueue:readlist_queue_actionslist_queue_historyEach sits behind a named permission. Holding one does not imply holding another.
runs:createcreate_alert_runcreate_assignment_runcreate_deduplication_runcreate_enrichment_runcreate_job_change_runcreate_mass_update_runcreate_normalize_runcreate_plancreate_records_runcreate_score_runcreate_segmentation_runcreate_verification_runupdate_plan_inputsruns:dispatchdispatch_runfire_planrun_job_change_sweepset_plan_scheduleruns:reversereverse_audit_eventruns:deletedelete_runtemplates:writecreate_rule_templatedelete_rule_templateset_assignment_configset_contact_owner_inheritanceset_new_employer_recordset_owner_modeset_tamupdate_rule_templatededup:mergeapprove_duplicate_groupreverse_duplicate_groupqueue:proposequeue_actionThe vocabulary
This is the whole list. What an agent may do on its own, and what it must bring back as a proposal, is a permission you set at the tenant level, not a prompt it can talk its way around.
crm:read Read the mirrored CRM records and the field catalog 5 toolsruns:read Read runs, their outcomes and why records were not written 9 toolsruns:preview Preview what a run would do, without running it 2 toolsruns:create Create runs, which do nothing until dispatched adminruns:dispatch Execute runs, which writes to the connected CRM adminruns:reverse Reverse a run that has already written adminruns:delete Delete runs, which discards their outcome and funnel permanently admintemplates:read Read the rule and mapping configurations, the TAM and its market whitespace 11 toolstemplates:write Create and change rule and mapping configurations admindedup:read Read duplicate groups and what merging one would do 2 toolsdedup:merge Merge duplicate records, whose undo is unmerge rather than a run-level reverse adminaudit:read Read the audit trail 2 toolsqueue:read Read the review queue and its history: what is waiting for a person, and what was approved, rejected or rolled back 2 toolsqueue:propose Propose CRM changes into the review queue, which change nothing until a person approves each one adminThe posture
On Growth and Enterprise, that sentence is a pair of permissions rather than a product tier.
Creating a run and dispatching it are separate permissions, and that separation is what makes the autonomy question a grant rather than an architecture. An agent holding the first and not the second can research your CRM, compose the exact operation that would fix what it found, scope it, and hand it to a person. It cannot write a single field.
Full autonomy is both permissions. Moving between the two is an administrator changing a grant, not a migration, not a different product, and not a setting the agent can reach.
Merging is held apart from everything else. A run writes under one audit event and reverses as a unit; a merge is the one operation whose undo is a different surface entirely. Bundling it with the permission to dispatch would mean granting the reversible and the irreversible with one word.
Blast radius
Nine of the 67 tools can reach anything outside this deployment.
Every read but one answers from LiveCRM's own mirror of your CRM, its own catalog and its own tables. The exception lists the companies a market segment is missing, and it does so with your data provider's free company search: no credits, and nothing written. The tool called count records is called that because it counts records, and it touches your CRM to do it exactly never.
The ones that do leave are declared as such, one by one, so a client knows before it calls. That is the same annotation MCP asks for and most servers set once for the whole catalogue.
The rest of it
Both sides of the desk
Point it here alongside the research tools it already has. One asks what is out there; this one knows what you already hold, and is the only one permitted to change it.