---
title: The MCP Server
description: "--- ## Introduction The **MCP server** (Model Context Protocol) from Kafinea allows external AI clients (Claude Desktop, Cursor, Windsurf, VS Code, JetBrains…) to connect to the ERP instance to query data via a standardized protocol. This page describes the technical…"
url: "https://www.kafinea.com/en/help/settings/the-mcp-server/"
updated: "2026-04-13"
category: Settings
---

# The MCP Server

---

## Introduction

The **MCP server** (Model Context Protocol) from Kafinea allows external AI clients (Claude Desktop, Cursor, Windsurf, VS Code, JetBrains…) to connect to the ERP instance to query data via a standardized protocol.

This page describes the technical architecture, security, and configuration of the MCP server for administrators.

---

## 1. Architecture

The Kafinea MCP server is composed of several components:

| Component | Role |
| --- | --- |
| HTTP Entry Point | Reception of MCP requests (Streamable HTTP protocol) |
| Tools | Functions exposed to AI clients (search, read, navigation) |
| Resources | Context data accessible by the AI client |
| Authentication | Validation of user credentials for each request |
| Security | Application of access rights and security controls |
| Configuration | Server activation and limitation parameters |

---

## 2. Authentication

Authentication is performed via the HTTP header `X-Kafinea-Credentials` in the format:

```
X-Kafinea-Credentials: username:accesskey
```

- The **username** is the Kafinea user name
- The **accesskey** is the user's access key (visible in My Preferences)

The server validates the credentials and establishes the user context for the request.

---

## 3. Security

### Access Rights

Each MCP request is executed in the context of the authenticated user. Access rights to modules, records, and fields are respected.

### Additional Security Controls

In addition to user access rights, the MCP server applies additional controls:

- Validation of input parameters
- Filtering of sensitive modules and fields
- Protection against injections

### Recommendations

- Deploy the MCP server only over HTTPS connections
- Never publish credentials in a public repository
- Monitor access logs to detect abnormal usage
- Use dedicated access keys for MCP integrations if possible

---

## 4. Exposed Tools

The tools exposed by the MCP server allow AI clients to:

- **Search** for records in Kafinea modules
- **Read** the details of a specific record
- **Navigate** relationships between records
- **List** available modules and fields

Each tool respects the access rights of the connected user.

---

## 5. Exposed Resources

Resources expose context data that the AI client can consult:

- Information about the Kafinea instance
- Structure of available modules
- Field metadata

---

## 6. Configuration

The MCP server configuration is managed by the server administrator. Parameters include:

- Server activation/deactivation
- List of exposed modules
- Request limits

> **Note:** Contact your server administrator if you wish to modify the list of exposed modules or request limits.

---

## 7. Activation

The MCP server is activated via Kafinea feature flags. To activate it:

1. Verify that the MCP feature flag is enabled in the configuration
2. Ensure that the endpoint `mcp/index.php` is accessible from outside (or from the user network)
3. Inform users that they can retrieve their configuration from **My Preferences > MCP Configuration**

---

## 8. Diagnostics

In case of connection issues:

1. Verify that the MCP endpoint is accessible from the user's workstation
2. Verify user credentials (valid username + accesskey)
3. Verify that the MCP feature flag is properly enabled
4. Consult the AI Agents Explorer to identify any errors

---

## FAQ

**Is the MCP server compatible with all AI clients?**
 The server implements the standard MCP protocol (Streamable HTTP). Any MCP-compatible client can connect to it.

**Can I limit the modules accessible via MCP?**
 Yes, via user profile access rights in Kafinea. The server administrator can also restrict the list of exposed modules at the server configuration level.

**Are MCP requests logged?**
 Yes, MCP activity can be viewed from the AI Agents Explorer in Kafinea.

---

## Related References

- [Connect an External AI (MCP)](/205_intelligence-artificielle/040_connecter-une-ia-externe-mcp.md)
- [AI Agents](https://www.kafinea.com/en/documentation/settings/ai-agents/)