MCP Server setup guide

The MihootCRM MCP Server lets third-party AI clients (Cursor, Claude Desktop, etc.) call CRM capabilities over the Model Context Protocol (MCP): search leads, contacts, opportunities, create tasks, trigger workflows, and more.

Not the same as “MCP servers” (Integrations)

• MihootCRM MCP server (this guide): expose CRM tools to external AI (inbound server).
• MCP servers (other card): connect external MCP servers into the built-in assistant (outbound client).

1. Overview

2. Prerequisites

1. Signed in with access to Integrations.
2. Permission crm:mcp:apikey:edit (or equivalent admin setup).
3. Client supports remote MCP over HTTP with Bearer auth.
4. Production: HTTPS (e.g. https://crm.example.com/mcp).

3. Create an API key

1. Open /integrations.
2. Find the MihootCRM MCP server card.
3. Click Create API key, name it (e.g. Cursor-dev).
4. Copy the full key or Cursor config from the one-time dialog.
5. After closing, only a masked prefix is shown — use Rotate if you lose the secret.

Personal keys
On the MihootCRM MCP server card, the key list shows only API keys bound to your signed-in account. Keys created by other members in the same tenant are hidden, and you cannot revoke or rotate someone else’s key. Each user may still create multiple keys (e.g. one for Cursor, one for Claude, one for testing).

Multiple keys

Each create adds a new row (different clients/environments). Revoke unused keys (trash icon).

List actions

4. API key format

mcp_<tenantCode>_<publicId>_<secret>

• tenantCode: 8-char obfuscated tenant segment — clients do not need a tenant header.
• Endpoint: https://<your-domain>/mcp

5. Cursor configuration

{
  "mcpServers": {
    "MihootCRM": {
      "url": "https://your-domain.com/mcp",
      "headers": {
        "Authorization": "Bearer mcp_<tenantCode>_<publicId>_<secret>"
      }
    }
  }
}

Reload MCP in Cursor and test, e.g. “use MihootCRM search_user for 5 users”.

6. Tools

Same catalog as the assistant: search_*, create_*, update_*, run_workflow, read_file, write_file. Write tools and run_workflow require appropriate CRM permissions on the bound account.

7. Security

• Treat keys like passwords; never commit to Git.
• Rotate and revoke on leak or offboarding.
• Use HTTPS in production.

8. Troubleshooting

Health check (no auth): GET /mcp/health → { "ok": true, ... }

9. Links