View Categories

The MCP Server

3 minutes

Introduction #

The MCP server (Model Context Protocol) from Kafinea allows external AI clients (Claude Desktop, Cursor, Windsurf, VS Code, JetBrains…) to connect to the ERP instance to query data via a standardized protocol.

This page describes the technical architecture, security, and configuration of the MCP server for administrators.

1. Architecture #

The Kafinea MCP server is composed of several components:

Component Role
HTTP Entry Point Reception of MCP requests (Streamable HTTP protocol)
Tools Functions exposed to AI clients (search, read, navigation)
Resources Context data accessible by the AI client
Authentication Validation of user credentials for each request
Security Application of access rights and security controls
Configuration Server activation and limitation parameters

2. Authentication #

Authentication is performed via the HTTP header X-Kafinea-Credentials in the format:

X-Kafinea-Credentials: username:accesskey
  • The username is the Kafinea user name
  • The accesskey is the user’s access key (visible in My Preferences)

The server validates the credentials and establishes the user context for the request.

3. Security #

Access Rights #

Each MCP request is executed in the context of the authenticated user. Access rights to modules, records, and fields are respected.

Additional Security Controls #

In addition to user access rights, the MCP server applies additional controls:

  • Validation of input parameters
  • Filtering of sensitive modules and fields
  • Protection against injections

Recommendations #

  • Deploy the MCP server only over HTTPS connections
  • Never publish credentials in a public repository
  • Monitor access logs to detect abnormal usage
  • Use dedicated access keys for MCP integrations if possible

4. Exposed Tools #

The tools exposed by the MCP server allow AI clients to:

  • Search for records in Kafinea modules
  • Read the details of a specific record
  • Navigate relationships between records
  • List available modules and fields

Each tool respects the access rights of the connected user.

5. Exposed Resources #

Resources expose context data that the AI client can consult:

  • Information about the Kafinea instance
  • Structure of available modules
  • Field metadata

6. Configuration #

The MCP server configuration is managed by the server administrator. Parameters include:

  • Server activation/deactivation
  • List of exposed modules
  • Request limits

Note: Contact your server administrator if you wish to modify the list of exposed modules or request limits.

7. Activation #

The MCP server is activated via Kafinea feature flags. To activate it:

  1. Verify that the MCP feature flag is enabled in the configuration
  2. Ensure that the endpoint mcp/index.php is accessible from outside (or from the user network)
  3. Inform users that they can retrieve their configuration from My Preferences > MCP Configuration

8. Diagnostics #

In case of connection issues:

  1. Verify that the MCP endpoint is accessible from the user’s workstation
  2. Verify user credentials (valid username + accesskey)
  3. Verify that the MCP feature flag is properly enabled
  4. Consult the AI Agents Explorer to identify any errors

FAQ #

Is the MCP server compatible with all AI clients?
The server implements the standard MCP protocol (Streamable HTTP). Any MCP-compatible client can connect to it.

Can I limit the modules accessible via MCP?
Yes, via user profile access rights in Kafinea. The server administrator can also restrict the list of exposed modules at the server configuration level.

Are MCP requests logged?
Yes, MCP activity can be viewed from the AI Agents Explorer in Kafinea.

Related References #