The ultimate guide to NetSuite MCP 2026.
NetSuite's MCP server is Oracle's hosted AI Connector Service — there is nothing to download. Tools come from the MCP Standard Tools SuiteApp, and the NetSuite role you pick at sign-in is the access boundary. Every route to it, compared on permissions, write access, maintenance, and cost.
Want the shortlist instead of the full map? Read 6 ways to connect AI to your NetSuite books. Setting up one specific client? Skip ahead to ChatGPT, Claude, Codex, or a local bridge.
The basics
What is NetSuite MCP?
The Model Context Protocol (MCP) is an open standard for connecting AI assistants to outside systems through one interface. NetSuite MCP is Oracle's implementation of it: the NetSuite AI Connector Service, a NetSuite-hosted endpoint that exposes approved tools to any compatible client.
This is where NetSuite parts company with QuickBooks and Xero, both of which publish a server you clone and run. NetSuite publishes a service you authorize. Tools arrive as a SuiteApp, authorization runs through OAuth 2.0, and the NetSuite role selected at consent decides everything the AI can reach. No scope list, no API key — a role.
So the real decisions are narrower than "can AI read NetSuite." They are: which client your users will actually use, which tools that client needs, whether anything is allowed to write, and who is still maintaining the setup six months after the pilot.
Under the hood
How a NetSuite MCP request actually travels.
Six links in the chain. Every failure and every permission question belongs to exactly one of them, which is why "just widen the role" fixes so little.
MCP client
ChatGPT, Claude, Codex, an IDE client behind a local bridge, or a managed layer such as Kipper. The client is the caller — it is never the permission system.
OAuth 2.0 authorization
Authorization Code Grant with PKCE. The person signing in picks a NetSuite role at consent time, and that choice scopes the whole connection.
NetSuite AI Connector Service
Oracle's hosted MCP endpoint, reached over streamable HTTP at MCP protocol version 2025-06-18. This is the NetSuite MCP server. There is nothing to download.
Tool package
The MCP Standard Tools SuiteApp supplies record, report, saved-search, and SuiteQL tools. Custom SuiteScript tools can be published alongside them.
NetSuite role
Every tool call executes as the selected role. Records it cannot see return fewer rows, blank fields, or a permission error — which is correct behavior, not a bug.
Execution log
NetSuite logs AI Connector Service activity per integration record. It records tool calls, not the question a person typed or the answer they were shown.
The two endpoint shapes
- MCP Standard Tools SuiteApp
-
https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools - Oracle's standard tool set — the endpoint used by the documented Claude flow.
- All tool namespaces
-
https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/all - Spans tool namespaces including custom tools. Check this first when tools are missing after a successful login.
The landscape
Three categories of option.
Official & developer
Oracle's hosted service, the Standard Tools SuiteApp, local bridges, CData's read-only server, and custom SuiteScript tools.
Managed cloud platforms
MCP gateways, agent platforms, iPaaS tools, and unified APIs that already support NetSuite, with the differences labeled plainly.
Hosted finance layer
A managed, read-only answer layer for teams that need governed NetSuite answers without every user holding a NetSuite seat.
Category 01 · Official & developer
The official service and developer routes
Every other path on this page sits on top of this one. Get the account side right — features, SuiteApp, a dedicated role — and swapping clients later is a five-minute job.
Official · Oracle NetSuite Start here whichever client you end up using NetSuite AI Connector Service
Oracle documentation ↗Oracle's hosted MCP endpoint for NetSuite. Enable Server SuiteScript and OAuth 2.0 (plus REST Web Services to install the standard tools), install a tool package, create a dedicated non-administrator role with MCP Server Connection and Log in using OAuth 2.0 Access Tokens, then authorize from your client. Oracle refuses the service on Administrator and full-permission roles, so scoped role design is built into the product rather than bolted on.
Its tools come from the MCP Standard Tools SuiteApp — records, reports, saved searches, and SuiteQL. The optional Companion SuiteApp adds prompt samples, not data access; the retired MCP Sample Tools SuiteApp is a different, deprecated package. When the standard tools cannot express a workflow, developers can build custom SuiteScript tools with SDF and expose them through the same service.
Full permission model, layer by layer- Transport
- Streamable HTTP · MCP 2025-06-18
- Auth
- OAuth 2.0 auth code + PKCE
- Permissions
- The NetSuite role, per connection
- Setup effort
- Medium, admin led
Community local bridge
Third-partyA local STDIO process that fronts Oracle's hosted service so IDE clients such as Claude Code, Cursor, or Gemini CLI can reach it. Reach for it when your client cannot complete Oracle's remote OAuth and streamable-HTTP flow, or when you need tooling the hosted service does not expose. It is a third-party dependency with a path to business data — review the maintainer, source, dependency tree, OAuth callback behavior, and exact tool list, then pin the version.
- Hosting
- Your machine, plus Oracle's endpoint
- Auth
- Public-client integration record + localhost callback
- Reviewed by Oracle
- No
- Setup effort
- High
CData NetSuite MCP Server
Vendor OSSA local Java MCP server that exposes NetSuite through CData's JDBC driver for Claude Desktop-style local clients. The server is open source and intentionally read-only; the commercial driver and driver configuration are the moving pieces you still have to own.
- Hosting
- Local Java process
- Transport
- Local stdio
- Write access
- Read-only by design
- Setup effort
- Medium-high
OpenSuiteMCP
Source-availableA self-hostable chat UI, from Unstacked Apps, that sits on Oracle's AI Connector Service: the Standard Tools, SuiteCloud Agent Skills, and a Companion prompt library in one interface you run yourself. Reach for it when you want a ready-made NetSuite chat app on Oracle's native endpoint instead of wiring a client yourself. Run it free with Docker, try it hosted, or have it installed in your VPC. It is source-available under a Sustainable Use License, so review the code, dependencies, and tool surface as you would any third-party path to business data.
- Hosting
- Self-host (Docker), hosted eval, or your VPC
- Auth
- OAuth 2.0 + PKCE via the AI Connector Service
- Reviewed by Oracle
- No
- Setup effort
- Low to medium
Building the local bridge yourself? Follow the developer setup guide, step by step
Category 02 · Paid, managed
Managed cloud platforms
MCP gateways, agent platforms, iPaaS tools, and unified APIs all offer NetSuite paths, and this is where false equivalence is easiest. Zapier, Composio, CData, Workato, and Tray.ai have MCP-relevant NetSuite paths. Boomi, Celigo, MuleSoft, Merge, and Apideck are strong integration or API options, but not verified NetSuite MCP servers.
Turnkey MCP
Managed platforms with a native MCP endpoint
Zapier NetSuite MCP
Hosted MCP gatewayZapier exposes selected NetSuite actions through a secure MCP URL, so an MCP-compatible assistant can call Zapier's NetSuite actions beside thousands of other app actions. It is action-first, not a NetSuite-native role design tool.
- Model
- Workflow/action MCP
- Hosting
- Zapier cloud
- Auth
- Zapier-managed app connection
- Write access
- Read-write actions
- Pricing
- Zapier plan + task usage
- Best for
- No-code cross-app actions
- Limitation
- Tool surface follows Zapier actions, not Oracle's full MCP Standard Tools
Composio NetSuite toolkit
Agent platformComposio positions NetSuite as a hosted toolkit for agents and chatbots, with OAuth handling and Tool Router MCP access across agent frameworks such as Codex, ChatGPT Work, Cursor, LangChain, and Mastra.
- Model
- MCP gateway / tool router
- Hosting
- Composio cloud
- Auth
- Managed OAuth2
- Write access
- Read-write tool-based
- Pricing
- Published usage tiers
- Best for
- Agent builders who need managed auth
- Limitation
- Still requires reviewing the exposed tools before production writes
CData Connect AI
Remote MCP + data layerCData Connect AI provides a hosted Remote MCP path to live NetSuite data and a broader data-connectivity layer. It fits IT and data teams that want governed query and action access across many sources rather than a NetSuite-only client route.
- Model
- Remote MCP / data platform
- Hosting
- CData cloud
- Auth
- CData-managed source connection
- Write access
- Vendor-scoped read/write
- Pricing
- Subscription
- Best for
- IT/data teams standardizing AI access
- Limitation
- Commercial layer and driver/source configuration to maintain
Workato Enterprise MCP
Enterprise MCP/iPaaSWorkato's Enterprise MCP layer can expose governed enterprise automations to agents, and its marketplace includes a NetSuite Financial Operations MCP Server built on Workato by Jade Global. This is an orchestration path, not Oracle's native endpoint.
- Model
- Enterprise MCP orchestration
- Hosting
- Workato cloud
- Auth
- Platform-managed connections
- Write access
- Read-write workflows
- Pricing
- Enterprise / marketplace-led
- Best for
- Enterprise automations with governance
- Limitation
- Recipe/server design and platform ownership required
Tray.ai Agent Gateway
Governed MCP gatewayTray.ai says its NetSuite connector can be exposed through Agent Gateway for MCP, with RBAC, observability, and governed tool calls. It is strongest when NetSuite is one of many enterprise tools an agent needs to orchestrate.
- Model
- Agent gateway / iPaaS
- Hosting
- Tray.ai cloud
- Auth
- Tray-managed connector auth
- Write access
- Read-write workflows
- Pricing
- Enterprise / sales-led
- Best for
- Governed multi-app agents
- Limitation
- Not a NetSuite-specific finance answer layer
Integration-led
Integration platforms & unified APIs
Reach NetSuite, but not a verified NetSuite MCP server.
Boomi
iPaaS / AI automationBoomi supports NetSuite integration and agentic automation inside Boomi workflows, including AI agent steps. Include it when the project is integration automation, not when the buyer expects a native MCP endpoint for an AI client.
- Model
- iPaaS / automation
- Hosting
- Boomi cloud / runtime
- Auth
- Boomi connection management
- Write access
- Read-write integrations
- Pricing
- Subscription / sales-led
- Best for
- Enterprise integration teams
- Limitation
- No first-party NetSuite MCP server claim found
Celigo
NetSuite iPaaSCeligo is a NetSuite-centered integration platform with broad templates and flows. It belongs in the managed integration comparison, but should not be described as an MCP server unless a specific MCP product is verified.
- Model
- NetSuite iPaaS
- Hosting
- Celigo cloud
- Auth
- Platform-managed NetSuite connection
- Write access
- Read-write flows
- Pricing
- Subscription / sales-led
- Best for
- NetSuite integration programs
- Limitation
- Integration platform, not verified MCP endpoint
MuleSoft NetSuite Connector
Enterprise connectorMuleSoft's NetSuite connector synchronizes data and automates processes through Anypoint. Treat it as an enterprise integration substrate that can sit near AI work, not as a drop-in NetSuite MCP option.
- Model
- Enterprise API/iPaaS connector
- Hosting
- Mule runtime / Anypoint
- Auth
- Connector configuration
- Write access
- Read-write integrations
- Pricing
- Enterprise / sales-led
- Best for
- Salesforce/MuleSoft shops
- Limitation
- Connector docs are not a NetSuite MCP product page
Merge
Unified accounting APIMerge abstracts NetSuite behind a unified Accounting API for product teams building customer-facing integrations. It is useful when your app needs normalized accounting data, not when an AI client needs Oracle's MCP tool surface.
- Model
- Unified API
- Hosting
- Merge cloud
- Auth
- Merge-managed customer connection
- Write access
- API-dependent read/write
- Pricing
- Subscription / sales-led
- Best for
- SaaS products embedding accounting integrations
- Limitation
- API layer, not MCP
Apideck
Unified accounting APIApideck provides a unified Accounting API with NetSuite support and documented CRUD coverage for entities such as subsidiaries. It belongs in a product-integration shortlist, but it is not a native NetSuite MCP server.
- Model
- Unified accounting API
- Hosting
- Apideck cloud
- Auth
- Apideck-managed connector auth
- Write access
- Read-write API operations
- Pricing
- Subscription / usage
- Best for
- Developers normalizing many accounting systems
- Limitation
- API abstraction, not MCP
Category 03 · Paid, hosted
Hosted finance layer
Best when the constraint is seat count rather than the connection. Under the native model, every extra person asking a question is a NetSuite user, a role assignment, and a role to review — which is why access tends to stop at the people who already have seats.
Kipper
Managed · read-onlyKipper connects NetSuite once, then lets people ask in plain language without SuiteApps, roles, bridges, or client configuration of their own. It is read-only by architecture, permissions are set per user or team in Kipper, and every question and answer is logged. The same connection answers in Slack, Teams, and SMS today, with Claude, ChatGPT, and Gemini through the Kipper MCP beta. It does not replace Oracle's service or its role model — your admin still authorizes a scoped NetSuite connection.
- Write access
- Impossible by architecture
- Permissions
- Per user / team, per query
- Pricing
- $1,000/month
- Included users
- Up to 20 active users
- Additional users
- $25/month per additional active user
- Best for
- Finance and operations teams that want managed access to NetSuite data
- Setup effort
- Low — hosted portal, no code
Everything compared
19 paths, two tables.
The first table is who a path is for and what it costs you in effort. The second is how it connects and what it can reach. MCP gateways, iPaaS platforms, and unified APIs are separated because they solve different problems.
Fit and effort
| Path | Category | Best for | Skill required | Setup effort | Who maintains it |
|---|---|---|---|---|---|
| AI Connector Service + Standard Tools | Native | The account-side foundation every other path sits on | NetSuite administration | Medium — features, SuiteApp, role | Oracle hosts it; your admin owns the role |
| NetSuite app in ChatGPT | Native client | Teams already standardized on ChatGPT | Low, once NetSuite is configured | Low in ChatGPT | NetSuite admin + ChatGPT workspace admin |
| NetSuite connector in Claude | Native client | A watchable first pilot — Claude prompts per tool call | Low, once NetSuite is configured | Low in Claude | NetSuite admin + Claude org owner |
| NetSuite in Codex | Native client | Developers who want ERP context in their coding client | Medium — config file and OAuth callback | Low to medium | The developer |
| Community local bridge | Community | Clients that cannot do Oracle's remote OAuth flow | High — you are vetting a dependency | High | You, including security review |
| CData local MCP server | Vendor OSS | Read-only local SQL-style access through CData JDBC | Medium-high — driver and Java config | Medium-high | You, plus CData driver upkeep |
| OpenSuiteMCP (self-host UI) | Source-available | A ready-made, self-hosted NetSuite chat UI on Oracle's endpoint | Low to medium — Docker plus NetSuite admin | Low to medium | Unstacked Apps; you host and review it |
| Custom MCP tools | Custom | Named workflows the standard tools cannot express | High — SuiteScript and SDF | High | Your developers, as production code |
| Zapier NetSuite MCP | Hosted MCP | No-code actions across NetSuite and many apps | Low-medium | Low-medium | Zapier, plus your Zapier admin |
| Composio NetSuite toolkit | Agent platform | Developers building agents with managed auth | Medium | Low-medium | Composio, plus your agent team |
| CData Connect AI | Remote MCP/data | IT/data teams standardizing AI access to many sources | Medium | Low-medium | CData, plus your data admin |
| Workato Enterprise MCP | Enterprise MCP/iPaaS | Governed enterprise automations and finance workflows | Medium-high | Medium | Workato admins and recipe owners |
| Tray.ai Agent Gateway | MCP gateway/iPaaS | Multi-app agents with RBAC and observability | Medium-high | Medium | Tray admins and workflow owners |
| Boomi | iPaaS | Enterprise integration teams wiring NetSuite into processes | Medium-high | Medium | Boomi integration owners |
| Celigo | NetSuite iPaaS | NetSuite-centered integration programs | Medium | Medium | Celigo integration owners |
| MuleSoft NetSuite Connector | Enterprise connector | MuleSoft estates automating NetSuite with other systems | High | Medium-high | MuleSoft integration owners |
| Merge | Unified API | SaaS products embedding customer NetSuite integrations | Medium | Medium | Merge plus your product engineering team |
| Apideck | Unified API | Developers normalizing accounting APIs across providers | Medium | Medium | Apideck plus your product engineering team |
| Kipper managed connector | Managed | Staff who will never hold a NetSuite login | None | Low — hosted portal, no code | Kipper, with your admin approving the connection |
Architecture and access
| Path | Hosting | Authentication | Permission model | Client type | Write capability | Main limitation |
|---|---|---|---|---|---|---|
| AI Connector Service + Standard Tools | Oracle hosted | OAuth 2.0 auth code + PKCE | NetSuite role, per connection | Any remote-MCP client | Role-scoped | One role per connection — different access means another role and another connection |
| NetSuite app in ChatGPT | Oracle hosted | NetSuite OAuth via the app | NetSuite role + workspace app policy | ChatGPT | Role-scoped | Availability varies by plan and workspace; some plans need developer mode |
| NetSuite connector in Claude | Oracle hosted | NetSuite OAuth via the connector | NetSuite role + Claude org settings | Claude | Role-scoped | Team and Enterprise plans need an Owner to enable it first |
| NetSuite in Codex | Oracle hosted | OAuth 2.0 auth code + PKCE | NetSuite role | Codex | Role-scoped | Redirect URI has to match the integration record exactly |
| Community local bridge | Your machine + Oracle endpoint | Public client + localhost callback | NetSuite role, plus whatever the bridge does | Local STDIO clients | Role-scoped | Unreviewed third-party code on a machine that can reach your books |
| CData local MCP server | Local Java process + CData driver | CData driver/source credentials | Driver connection and NetSuite account permissions | Local STDIO clients | Read-only | Read-only SQL-style layer; driver licensing/configuration still required |
| OpenSuiteMCP (self-host UI) | Self-host (Docker), hosted eval, or your VPC | OAuth 2.0 + PKCE via the AI Connector Service | NetSuite role, per connection | Self-hosted chat UI | Role-scoped | Source-available third party you host and review; not an Oracle-reviewed build |
| Custom MCP tools | Oracle hosted | OAuth 2.0, manual integration record | Role, plus the tool's own SuiteScript logic | Any remote-MCP client | Read-write | You own the design, testing, and rollback of anything it can change |
| Zapier NetSuite MCP | Zapier cloud | Zapier-managed NetSuite connection | Zapier connection plus selected MCP actions | Any MCP-compatible client | Read-write | Action list and task pricing follow Zapier, not Oracle's tool package |
| Composio NetSuite toolkit | Composio cloud | Managed OAuth2 | Composio connection and tool scopes | Agent frameworks and MCP clients | Read-write | Tool surface and production writes need review |
| CData Connect AI | CData cloud | CData-managed source connection | CData governance over NetSuite source | Remote MCP / AI tools | Read-write | Commercial data layer, not Oracle's role-native endpoint |
| Workato Enterprise MCP | Workato cloud | Platform-managed connections | Workato recipes, MCP server config, platform RBAC | Enterprise agents / MCP clients | Read-write | Requires Workato design, governance, and recipe ownership |
| Tray.ai Agent Gateway | Tray.ai cloud | Tray-managed connector auth | Tray workspace RBAC and tool policy | Agents and MCP clients | Read-write | General governed tool gateway, not NetSuite-only finance Q&A |
| Boomi | Boomi cloud / runtime | Boomi connection management | Boomi process permissions | Boomi workflows and agents | Read-write | Integration automation; no verified NetSuite MCP endpoint |
| Celigo | Celigo cloud | Celigo-managed NetSuite connection | Integration flow configuration | Celigo flows | Read-write | NetSuite iPaaS, not verified MCP |
| MuleSoft NetSuite Connector | Mule runtime / Anypoint | Connector configuration | Mule app policy and NetSuite role/token setup | Mule apps/APIs | Read-write | Enterprise connector, not direct AI-client MCP |
| Merge | Merge cloud | Merge-linked customer connection | Merge unified API permissions | Your product/API client | Read-write | Normalized accounting API, not MCP |
| Apideck | Apideck cloud | Apideck connector auth | Apideck unified API permissions | Your product/API client | Read-write | Normalized accounting API, not MCP |
| Kipper managed connector | Kipper cloud | One admin-authorized NetSuite connection | Kipper permission sets over approved data | Slack, Teams, SMS + MCP clients in beta | Impossible | Scoped to the finance records Kipper reads — not a general NetSuite tool runner |
Role-scoped means the path can read or write whatever the selected NetSuite role permits — including nothing beyond View, if that is how the role is built. Hosted platform claims were checked against first-party vendor pages, August 2026. This surface is still moving; re-verify before relying on it.
Developer decision guide
Pick the route by the problem you are solving.
Start with Oracle's NetSuite AI Connector Service when client compatibility is there. Move away from it only when the client, workflow, or audience forces a different shape. Use the permissions guide and SuiteQL guide before production data is involved.
Choose Oracle's official route when
- Your AI client supports remote MCP, streamable HTTP, OAuth 2.0, and PKCE
- The Standard Tools SuiteApp covers the use case
- A NetSuite administrator can create and review the role directly
- The rollout can live with one role per connection
Choose a local or community bridge when
- The client only supports a local stdio MCP server
- Oracle's remote transport or OAuth callback does not work in that client
- Your team accepts security review, version pinning, and maintenance
- The package source, dependencies, and callback behavior have been reviewed
Choose a hosted cloud platform when
- The workflow spans NetSuite plus CRM, ticketing, email, warehouse, or project systems
- You want managed authentication and platform logs
- The use case needs actions or automations, not just finance answers
- You are comfortable with task, tool-call, or enterprise platform pricing
Choose a finance-focused hosted layer when
- Business users need answers, not raw tools or NetSuite screens
- Per-user permissions and question-level audit matter
- The organization wants one governed rollout across Slack, Teams, SMS, and MCP-enabled clients
- Users should not need NetSuite seats or local client setup
Tools and data
What NetSuite MCP can reach.
The MCP Standard Tools SuiteApp ships four tool families plus room for your own — this is the native NetSuite surface, the ceiling for what a direct connection can reach before a role or a managed layer like Kipper narrows it. Picking the right family for a question matters more than prompt wording.
| Tool family | Tools | Access | Best for | Watch out for |
|---|---|---|---|---|
| Record tools | ns_getRecord, ns_getRecordTypeMetadata, ns_createRecord, ns_updateRecord | Read and write | One specific record, by ID or lookup | The only write path in the standard set. Gated by the REST Web Services role permission plus create or edit rights on the record type. |
| Report tools | ns_listAllReports, ns_runReport, plus ns_getSubsidiaries, ns_getAccountingBooks, ns_getAccountingContexts, ns_getNexusIds for filtering | Read only | Standard and custom reports the role can already access | Seeing a report in the NetSuite UI does not prove ns_runReport returns the same thing for the connected role. Test the reports your team actually depends on. |
| Saved-search tools | ns_listSavedSearches, ns_runSavedSearch | Read only | Trusted operational lists and filters finance already maintains | Needs Perform Search plus visibility of each search to the role. A saved search still needs a named owner. |
| SuiteQL tools | ns_runCustomSuiteQL, ns_getSuiteQLMetadata | Read only | Ad hoc structured retrieval, joins, grouped analysis | A generated query can be syntactically valid and financially wrong. Read-only is not the same as low-risk. |
| Custom tools | Account-specific | Whatever the tool defines | Workflows you want encoded once rather than improvised | The tool definition, its SuiteScript, its deployment, and the role all matter. Review it like production code. |
SuiteQL is the family teams over-reach for. When a figure already exists as a report or a saved search, that is usually the safer answer — the logic has an owner and a history. SuiteQL access explained works through the trade-off in detail, including query limits, field IDs, and pagination.
Entities
Customers, vendors, employees, subsidiaries, departments, classes, and locations — as records and as the scope that filters everything else.
Transactions
Invoices, bills, payments, bill payments, credit memos, vendor credits, sales orders, purchase orders, and their line items.
Items and inventory
Item records, quantity on hand, and bills of materials, subject to the location and subsidiary scope on the role.
Custom records
Account-specific record types. Confirm the record type ID, the field IDs, and the audience restrictions before exposing one.
Reports and saved searches
Standard and custom reports, plus saved searches — the places where your finance logic already lives.
SuiteQL results
Structured rows across records the role can reach, with joins and aggregation SuiteQL supports.
None of that is a guarantee. Actual access depends on six things.
- Which tool package is installed — no SuiteApp means no standard tools to expose
- Which endpoint the client points at: the SuiteApp URL or the /all namespace
- Which NetSuite account features are enabled, and on which release
- Which role was selected at OAuth consent — not which role the person usually uses
- That role's record, report, saved-search, and SuiteQL permissions, reviewed separately
- The client's own limits — roughly 5,000 rows per call, plus token and timeout ceilings
Permissions & security
Eight layers, and they fail independently.
The most expensive mistake in a NetSuite MCP rollout is fixing a failed prompt by widening the role. Account features, SuiteApps, OAuth, connection permissions, record access, report access, the write gate, and the AI client's own policy are separate switches. Find the one that failed.
REST Web Services causes more confused debugging than anything else, because it is two different things with the same name. As an account feature it lets you install the Standard Tools SuiteApp. As a role permission it lets that role reach records — including creating and updating them. Enabling the feature does not grant the permission, and a read-only Q&A role should have the feature on account-wide and the permission off.
The connection is not read-only by nature. ns_createRecord and ns_updateRecord ship in the standard set. Read-only is something you design.
| Layer | What it controls | What to check | Owner |
|---|---|---|---|
| Account features | Whether the AI Connector Service path can run at all | Server SuiteScript and OAuth 2.0 always; REST Web Services to install the Standard Tools SuiteApp | NetSuite administrator |
| SuiteApps | Which tools exist to be exposed | MCP Standard Tools; optionally the Companion prompt library or your own custom tool package | NetSuite administrator |
| OAuth and integration record | Which client can authenticate, and where the callback goes | Auto-created for the Standard Tools route; manual for custom tools and local bridges | NetSuite admin + AI-client admin |
| MCP connection permissions | Whether a role may use the service at all | MCP Server Connection and Log in using OAuth 2.0 Access Tokens, both under Permissions › Setup | NetSuite administrator |
| Record permissions | Which records and fields can be read or changed | Transaction, list, setup, and custom-record permissions, at View unless a tested write workflow needs more | Role owner |
| Report and search permissions | Which reports run and which saved searches are visible | Report access plus Perform Search, and the subsidiary or classification scope each one needs | Role owner |
| Write gate | Whether the two write tools appear at all | REST Web Services as a role permission, on top of create or edit rights for the record type | Role owner |
| AI-client controls | Which app, connector, or MCP server users may reach | Workspace app policy, org-level connector enablement, developer mode | ChatGPT, Claude, or Codex admin |
- Is the connection running on a dedicated non-administrator role? Oracle blocks Administrator and full-permission roles outright.
- Does that role hold MCP Server Connection and Log in using OAuth 2.0 Access Tokens — not the older, similarly named Log in using Access Tokens?
- Is the REST Web Services role permission off, so ns_createRecord and ns_updateRecord never appear?
- Are Accessible Subsidiaries and cross-subsidiary viewing scoped deliberately rather than set to All for convenience?
- Are custom records included only where someone has confirmed the record type, fields, and audience?
- Has the integration record been reviewed, and is token revocation documented for when someone leaves?
The one-minute acceptance test
Connect, ask the client to list its available NetSuite tools, and confirm ns_createRecord and ns_updateRecord are absent. If they appear on a role you meant to be read-only, fix the role before anyone asks a real question.
Least-privilege role matrices for AR, AP, inventory, and executive accessSetup at a glance
The NetSuite half barely changes.
Features, SuiteApp, dedicated role, assignment — that work is the same whichever client you connect. What differs is the client half and the one thing most likely to trip you up. Each row links out to the guide for that path.
| Path | In NetSuite | In the client | The thing that catches people | Full guide |
|---|---|---|---|---|
| ChatGPT | Features, SuiteApp, scoped role | Apps › search NetSuite › Connect › Sign in to NetSuite | Confirm the app is visible on your plan and workspace before touching NetSuite permissions | ChatGPT guide → |
| Claude | Features, SuiteApp, scoped role | Search and tools › Add connectors › paste the Standard Tools Server URL › Connect | Adding the connector is not connecting it; Team and Enterprise need an Owner to enable it first | Claude guide → |
| Codex | Features, SuiteApp, scoped role | Plugins › NetSuite, or [mcp_servers.netsuite] in ~/.codex/config.toml then codex mcp login | Register the exact redirect URI Codex presents, including port and path | Codex guide → |
| Local bridge | Features, SuiteApp, public-client integration record, scoped role | Reviewed and pinned package in your MCP client config, with env vars in the config block | The callback port in NetSuite and in your client config must match exactly | Local bridge guide → |
| Custom tools | Features, tool package via SDF, manual integration record, scoped role | Point the client at the /all namespace endpoint | No integration record is created for you on this path | SuiteQL & tool choice → |
| Kipper | One admin-authorized connection with a scoped role | Invite users and set permissions in the Kipper portal | Review the Kipper permission sets and the source NetSuite role — they are two control planes | Kipper connector → |
Agents & automations
Build the read path first.
Six patterns that the standard tools genuinely support, with the tools each one needs and whether it requires the write gate open. An agent that reads badly gives someone a wrong number; an agent that writes badly is a record somebody has to find and clean up.
| Pattern | Concrete example | Tools | Writes? | Design note |
|---|---|---|---|---|
| Retrieval agent | Answer "is invoice 10234 paid?" or "what is the quantity on hand for SKU-9032?" on demand | Record tools, SuiteQL | No | The safest thing to build first, and the one that proves the role, endpoint, and client all point at the same account. |
| AR follow-up preparation | List customers with invoices past 60 days, with amount and oldest due date, and draft the outreach for a person to send | SuiteQL or a saved search | No | Draft, never send. The agent assembles the list; a human owns the customer relationship. |
| AP payment-run preparation | List vendor bills coming due inside seven days, grouped by vendor, for a human to approve | Saved search, record tools | No | Preparation is read-only. The approval and the payment stay in NetSuite, with NetSuite's own approval routing. |
| Inventory watch | Flag items below a threshold on hand in one location and post the list to a channel | SuiteQL, record tools | No | Give it an explicit threshold and location. "Anything unusual" is not a specification an agent can honor. |
| Report assistant | Run an AR aging summary for one subsidiary and summarize the movement since the last run | ns_runReport with ns_getSubsidiaries | No | Test the specific report first. Report parity with the UI has to be proven per report, not assumed. |
| Record maintenance | Update a named field on a specific record after a human confirms the change | ns_updateRecord | Yes | The only pattern here that needs the REST Web Services role permission. Scope it to one record type and keep a human in the confirm step. |
Guardrails worth writing down before the first run.
NetSuite's approval routing, period locks, and audit trail already exist. An agent should feed them, not go around them.
- Test every workflow in a sandbox account first, with a sandbox-only role
- Keep the write gate closed until a named, tested workflow needs it — then open it for one record type, not for the role
- Put a human approval step in front of anything that creates, updates, approves, submits, or sends
- Make write calls idempotent: target a specific internal ID, and check current state before changing it
- Give the agent a role of its own so the execution log attributes calls to the automation, not to a person
- Log the prompt and the answer on your side — NetSuite's execution log records tool calls, not what anyone asked
- Re-run the tool-discovery check after any role change; permissions drift and tool lists change with them
Two follow-ups worth having open while you build: the permission model for scoping the agent's own role, and SuiteQL access explained for row limits, pagination, and why a query can be valid and still wrong.
No code required
If you only want answers, skip the server.
Nobody needs to maintain an MCP bridge to find out whether an invoice is paid. Use an approved ChatGPT or Claude connection if the people asking already hold NetSuite seats, or a managed connector when they never will. These are the questions that come up first, and the tool family that answers each. For the longer list, grouped by who asks, see 30 questions you can ask AI about your NetSuite data.
Accounts receivable
Sales and account reps
- "Which customers have invoices more than 60 days overdue?"
- "Is invoice 10234 paid?"
- "What is this customer's open balance?"
Usually · SuiteQL or an AR saved search
Accounts payable
Procurement and ops
- "Which vendor bills are due in the next seven days?"
- "Have we paid this vendor's last bill?"
- "What is outstanding on this purchase order?"
Usually · Record tools, saved search
Sales orders and quotes
Sales and customer service
- "What open sales orders does this account have?"
- "What is the status of this order?"
- "Which quotes are still open for this customer?"
Usually · Record tools, SuiteQL
Inventory
Warehouse and service staff
- "What is the quantity on hand for SKU-9032?"
- "Which items are below their reorder point in this location?"
- "What is on the bill of materials for this assembly?"
Usually · SuiteQL, record tools
By class or department
Cost-center and project owners
- "Which invoices in my department are still unpaid?"
- "What purchase orders are open against this class?"
Usually · SuiteQL with the class or department filter
Period lookups
Executives away from a desk
- "How much did we invoice this month compared with last month?"
- "Which invoices issued in the period are still open?"
Usually · SuiteQL, or a report run with ns_runReport
Two honest caveats. Report-shaped questions — a period AR aging summary,
or a figure scoped to one subsidiary — run through ns_runReport on Oracle's native path and depend on the role's report permissions, so
test the specific report. And month-end close, reconciliation, and budget-versus-actual
work are processes finance runs inside NetSuite, not lookups an MCP tool answers
— treat those as out of scope for any of these routes.
Side by side
Oracle-native or a managed layer?
These are not competing versions of the same thing. Oracle's service connects a client to NetSuite tools. A managed layer answers questions for people who will not be configuring a client. Nine dimensions where the difference actually shows up.
| Dimension | Oracle-native path | Kipper managed connector |
|---|---|---|
| Who owns setup | NetSuite admin, plus the AI client's workspace admin | Kipper onboarding, with your admin authorizing one connection |
| Per-person cost of adding someone | Another NetSuite user, another role assignment, another role to review | A permission grant in the Kipper portal — no NetSuite login |
| Maintenance | Features, SuiteApp updates, integration records, roles, and one client config per user | One connection Kipper maintains |
| Business-user accessibility | Assumes the user understands records, roles, reports, and tool calls | Plain questions in Slack, Teams, SMS, and MCP clients in beta |
| Permission governance | NetSuite roles — powerful, and the only lever you have | Kipper permission sets over the approved connection, reviewed alongside the source NetSuite role |
| Write exposure | A role design decision. Two write tools ship in the standard set | Read-only by architecture — there is no write path to enable |
| Audit trail | NetSuite execution logs record tool calls per integration record | Every question and answer logged, on top of the NetSuite side |
| Customization | Unlimited, via custom SuiteScript tools | Bounded by the finance records Kipper reads |
| Cross-interface reach | Whichever MCP client each person configures | One connection behind Slack, Teams, SMS, and the MCP beta |
Kipper does not replace Oracle's AI Connector Service or its role model — a NetSuite admin still authorizes a scoped connection. See the NetSuite MCP connector, or a governance-first read of the native route in what finance teams still need to check.
Known limits
Fourteen things to know before the rollout plan hardens.
| Limitation | Practical effect |
|---|---|
| Administrator role blocked | Oracle refuses the AI Connector Service on Administrator or any full-permission role. Role design is unavoidable work, not optional hardening. |
| One role per connection | The connection sees exactly what that one role sees. Different access for different people means another role and another connection. |
| Per-user NetSuite seats | The connected identity is a NetSuite user, so a broad rollout is a licensing question before it is a technical one. |
| Client compatibility | Clients need remote MCP, streamable HTTP, protocol version 2025-06-18, and OAuth 2.0 auth code with PKCE. Not every client does all four — which is the whole reason local bridges exist. |
| Plan and workspace gating | ChatGPT availability depends on plan and workspace app policy, and some plans require developer mode. Claude Team and Enterprise need org-level enablement. |
| Report parity is not guaranteed | ns_runReport runs reports the role can access, but matching a UI report exactly still needs testing per report. |
| Saved-search visibility | A saved search has to be visible to the role, and its definition still needs an owner who understands the logic inside it. |
| Row and token ceilings | AI clients typically handle around 5,000 rows per call. Large extracts time out rather than paginating quietly. |
| SuiteQL is not portable SQL | SuiteQL supports SQL-92 or Oracle SQL syntax but not both in one query, over NetSuite's own records, fields, and functions. Queries from a warehouse rarely run unchanged. |
| Custom records need groundwork | Record type IDs, field IDs, and audience restrictions vary per account. Confirm all three before exposing one. |
| Write tools ship by default | The standard set includes ns_createRecord and ns_updateRecord. The connection is read-only only if you leave the REST Web Services role permission off. |
| Local bridges are unreviewed | Community packages are not developed or verified by Oracle. Read the source, pin the version, and treat it as a dependency with access to your books. |
| Audit trail is NetSuite-side | Execution logs record tool calls, not the question a person typed or the answer they were shown. |
| The surface is still moving | Oracle, OpenAI, and Anthropic are all shipping into this. UI labels, availability, and tool lists change — re-verify before a rollout plan hardens. |
Diagnose fast
Identify the path before you change anything.
A ChatGPT availability problem, a Claude org-enablement problem, a Codex transport problem, and a bridge callback problem all look like "NetSuite isn't working." They fail in completely different places.
| Where | Symptom | Likely cause | What to do |
|---|---|---|---|
| ChatGPT | NetSuite is not in the directory | Plan eligibility, workspace app policy, or a plan that needs developer mode | Check the directory under both Apps and Plugins, then ask the workspace admin — do not change NetSuite permissions first |
| Claude | Connector will not add | Server URL copied wrong, or the org has not enabled it | Use the exact account ID in the SuiteApp URL; on Team or Enterprise have an Owner enable the connector |
| Codex | Server listed but disconnected | Transport mismatch, wrong profile, or invalid config syntax | Check ~/.codex/config.toml, then codex mcp list and codex mcp get netsuite |
| Local bridge | OAuth callback never completes | Port conflict or a redirect URI that does not match the integration record | Align the callback port in the client config with the Redirect URI in NetSuite, character for character |
| OAuth | Role is rejected, or missing from the picker | Administrator or full-access role, an unassigned role, or a stale NetSuite session | Assign the role to the signing-in user, sign out of NetSuite completely, then retry |
| Permissions | Connected, but no tools appear | Missing SuiteApp, wrong endpoint, or a role without MCP Server Connection | Install MCP Standard Tools, check the SuiteApp versus /all endpoint, then reconnect in a fresh session |
| Record tools | Read tools work, record writes fail | The role is missing the REST Web Services permission | Add it only if this role is genuinely meant to change records |
| Reports | A report the role can open in NetSuite will not run | Report shape does not survive the round trip for that role | Try a saved search or SuiteQL for the same figure, and test report support per report |
| SuiteQL | Query fails or returns nothing | Wrong field IDs, unsupported syntax, mixed SQL dialects, or a role limit | Call ns_getSuiteQLMetadata first, then simplify to one table and add joins back one at a time |
Cost compared
What each path actually costs.
Oracle does not publish NetSuite seat pricing, so the honest framing is structural rather than numerical: on every native path the connected identity is a NetSuite user, which makes a broad rollout a licensing conversation before a technical one. Budget the recurring internal cost too — role design, sandbox testing, and log review do not stop after go-live.
| Path | Software | Hosting / infra | Ongoing cost | Notes |
|---|---|---|---|---|
| AI Connector Service + Standard Tools | Oracle capability plus a SuiteApp install | Oracle hosted | NetSuite licensing, per connected user | Availability depends on account features and release. Oracle does not publish seat pricing. |
| ChatGPT, Claude, or Codex | AI client subscription | Vendor cloud | Plan dependent, per user | An AI plan buys the client, not NetSuite access — the NetSuite seat and role still apply |
| Community local bridge | Free open-source package | The developer's machine | Your time, plus a real security review | Free to install, not free to own. Budget the review and version pinning. |
| CData local MCP server | Free open-source server | Local Java + CData JDBC driver | Driver licensing plus your config/support time | Read-only server; CData Connect AI is the commercial hosted route. |
| Custom MCP tools | Your SuiteScript and tool definitions | Oracle hosted | Developer build plus admin maintenance | Highest ceiling, highest carrying cost. Price it like an internal integration. |
| Zapier NetSuite MCP | Zapier subscription | None for the customer | Plan and task usage | Useful for action automation; budget around task/call volume. |
| Composio | Usage-tier subscription | None for the customer | Published free and paid tool-call tiers | Best priced as an agent platform, not a finance seat replacement. |
| CData Connect AI | Subscription | None for the customer | Subscription / plan dependent | Remote MCP plus enterprise data connectivity across many sources. |
| Workato / Tray.ai / Boomi / Celigo / MuleSoft | Enterprise platform subscription | Vendor cloud or enterprise runtime | Contract and implementation dependent | These are integration platforms; implementation effort is part of the price. |
| Merge / Apideck | Unified API subscription | Vendor cloud | Subscription and usage dependent | Most relevant to SaaS products embedding NetSuite integrations. |
| Security and admin review | — | — | Internal time per rollout | Role design, sandbox testing, and log review are the recurring cost every native path shares |
| Kipper | Subscription | None for the customer | $1,000/month — up to 20 active users, plus $25/month per additional active user | Request a demo. Billed on active users, not provisioned seats. |
Kipper bills on active users — people who ask at least one billable question in a calendar month — not on provisioned seats. Full detail on the pricing page.
The bottom line
Your next step, by who you are.
Developers
Start with Oracle's hosted connector — point a remote-MCP client at the Standard Tools endpoint and authorize with a scoped role. Reach for a local bridge only when your client cannot complete Oracle's remote OAuth and streamable-HTTP flow, and for custom SuiteScript tools only when a workflow needs logic the standard tools cannot express.
Set up NetSuite MCP locallyAgent & automation builders
Managed gateways — Zapier, Composio, Workato — expose NetSuite actions to your agent without running a server, but they're built to act. Decide read-vs-write first, give the automation its own scoped role, and keep a human in front of every write.
The six ways to connect AI to NetSuite, comparedIT & data teams
If your team thinks in SQL and wants one governed query surface, SuiteQL through the AI Connector is the data route — scoped by the NetSuite role rather than a separate permission model. CData fits when you're standardizing AI access across many sources.
NetSuite MCP SuiteQL access explainedFinance, ops & the whole company
You don't need to run an MCP server to get answers out of NetSuite. When the people asking will never hold a NetSuite seat — and read-only access, per-user permissions, and an audit trail are requirements — a managed layer connects once and answers in Slack, Teams, SMS, and AI clients.
See Kipper's NetSuite MCP connectorFAQ
NetSuite MCP: frequently asked questions
The questions NetSuite admins, developers, security reviewers, and finance teams ask most.
Keep reading
6 ways to connect AI to your NetSuite books
The shortlist, head to head: Oracle native, custom tools, bridges, CData, gateways, Kipper.
Read30 questions you can ask AI about your NetSuite data
What sales, service, warehouse, and ops teams actually ask — and what comes back.
ReadSet up a local NetSuite MCP bridge
For IDE clients that cannot reach Oracle's endpoint directly.
ReadConnect NetSuite to Claude using the connector
Oracle's official connector path, end to end, with screenshots.
ReadConnect NetSuite to Codex using the plugin
The plugin, the config.toml entry, and the OAuth callback.
ReadConnect NetSuite to ChatGPT using the app
The Apps route, the required role, and a safe first test.
ReadNetSuite MCP permissions explained
Every layer, plus least-privilege role matrices.
ReadNetSuite MCP SuiteQL access
Read-only behavior, row limits, field IDs, and safe examples.
ReadNetSuite MCP troubleshooting
Path-first diagnosis for OAuth, roles, tools, and reports.
ReadNetSuite's ChatGPT app, reviewed
What Oracle documents, what it doesn't, and what to ask.
ReadKipper's NetSuite MCP connector
The managed, read-only route for teams.
ReadWant NetSuite answers, not roles to maintain?
Kipper is the managed, read-only route: one authorized NetSuite connection, and answers in Slack, Teams, SMS, and MCP-enabled AI clients — for the people who will never get a NetSuite login.
Sources & further reading