On Page Navigation
On Page Navigation
The Frappe MCP connector lets an AI agent read and write any DocType on your site, and manage your Builder pages besides. We wrote it, it is free, and it is open source, so installing it costs you nothing at all. What nobody hands you is a decision about which DocTypes that agent may reach, which user it connects as, and what happens the first time it misreads an instruction. That is the part we run.
Narrow by design, not by accident
Installing the connector takes an afternoon, and we built it to be that easy on purpose. Far fewer people will sit down first and work out what an agent should never be allowed to do. The second job is the one that matters once the agent can post to your general ledger.
So the setup below is mostly about boundaries. Which doctypes an agent may read, which it may write, and which it must never touch at all. A dedicated user with its own role profile, so the agent's permissions are visible in one place instead of quietly inherited from whoever set it up. Credentials that can be revoked without breaking anything else. Every call logged and attributable to a request. And a written scope you approve before the connector is ever pointed at production, because the alternative is discovering the limits by accident.
Frappe enforces role permissions on every single request, which is a real protection and also the thing people accidentally switch off. Connect the server as System Manager and the agent inherits every role that user holds, including a great deal nobody intended it to reach. We build a service user with a role profile shaped to the job, so the ceiling is set deliberately rather than by accident.
Every server starts able to look and not touch. Write tools go on individually, each one tested before the next is added. Submit and cancel come last of all, because a submit posts to the ledger and a cancel reverses it with an amendment trail behind it. Plenty of setups never enable those two at all.
Frappe Cloud makes a staging site inexpensive, so prompts run against a copy of your own data before anything points at the live bench. The interesting failures happen somewhere harmless. What a model does with an ambiguous instruction is worth learning before it is holding your ledger.
Role permissions set the ceiling at DocType level. User permissions narrow it to particular companies, warehouses or territories. Most setups configure one and forget the other, which is how an agent scoped to a single company quietly reads the whole group. We read both, write down what was granted, and say why.
One document covering every DocType exposed, every tool enabled and the service user sitting behind them. When somebody asks whether the agent can see Salary Slip, that becomes a lookup rather than an investigation.
The server runs against your own site on your own credentials, and the connector itself is open source and stays that way. We manage it rather than own it, so leaving costs you a revocation and a handover document rather than a migration.
Why a shorter list beats a quicker one
Most teams connect an agent the quickest way that works, which usually means an API key generated against whichever account already had System Manager. Nothing goes wrong on day one. Every row below is about who carries the consequence later.
Wiring it up in a hurry means generating an API key against whoever already held System Manager. The agent inherits that reach permanently, and nobody goes back to narrow it.
The fast path enables every tool at once, submit and cancel included. That is fine until an agent reads a vague instruction generously and posts something somebody then has to reverse by hand.
Role permissions and user permissions are both real protections, and both only work if a person reads them. Configured in a hurry, they become a permission set nobody can describe six months later.
Keys expire, permissions change and clients stop authenticating. Coverage includes unlimited repairs on the connections we manage, with no charge per incident and no queue to join.
An MCP server sits directly on top of your DocTypes, so a renamed custom field or a major version upgrade can quietly alter what a tool returns. We test that on staging rather than hear about it from you.
Frappe writes a Version record for every change and almost nobody opens them. Without somebody reading them, a tool being used in a way nobody intended stays invisible until it matters.
Where this pays for itself
This earns its place fastest where an agent is already reaching live ledger data, or where somebody is about to connect one and nobody has yet decided what it should be allowed to do.
How the build runs
The first conversation is about what an agent must never be allowed to do. That is harder than standing the server up, and it is the part that decides whether any of this goes well.
1
Which DocTypes the agents genuinely need, which tools against them, and which user the server runs as. We argue for a shorter list than most people start with, and write down what was left out and why.
2
The server goes up able to look and not touch, connected under a dedicated service user with both permission layers reviewed. Prompts run against a staging bench so the failure modes show up well before live data is involved.
3
Write tools go on one at a time, each tested before the next, with submit and cancel last of all or not at all. After that it is monitoring, Version review, repairs when a connection drops, and a monthly note on what the agents actually did.
Pricing
Monthly Subscription
DETAILS
Monthly Subscription
DETAILS
Testimonials
Everything included
