What an MCP server is
The Model Context Protocol (MCP) is an open standard through which AI assistants reach other systems. Instead of exporting data from the ERP and pasting it into a chat window, the AI asks for itself — through fixed tools the ERP provides.
facturado ships such an MCP server. Your ERP becomes a data source for the AI you already work with — Claude or Cursor, for instance. You ask a question, the AI picks the matching tool, facturado answers from your data.
What matters is not that an AI reaches the ERP, but through what: a tool is a permission. Whatever an ERP offers over MCP, a language model can call — including at a moment nobody expected. That is why facturado's toolbox is deliberately small.
Query customers, articles, documents, line items and totals. Read-only.
Small, harmless records such as tasks and notes. Never documents, prices or master data.
Analysing data
Every tool the MCP server offers today reads. None of them creates, changes or deletes anything.
An outside AI shines where a single query is not enough: setting several figures side by side, comparing them, building a table or chart, explaining an outlier. facturado supplies the figures, the AI the analysis.
Examples:
- "Compare revenue over the last four quarters and show the trend as a table."
- "Which customers had revenue last year but no order yet this year?"
- "Which quotes above €5,000 have been open for more than 30 days?"
- "At which prices did we sell the 20 mm aluminium plate this year?"
- "How much did we buy from our suppliers in September?"
The tools the MCP server offers for this:
Search by company name, customer, debitor or creditor number and VAT id — with a match confidence.
Search by article name, article number or drawing number — with unit and available stock.
Quotes, orders, outgoing and incoming invoices by customer, status and period — individually with every line item.
Net and gross totals per currency and status — computed in the database, across every matching document.
The route through the article: which documents contain it, in what quantity and at what price.
Today's date with week and month boundaries — so "this quarter" is not guessed from the model's training cut-off.
Every list is capped at 20 hits and carries only the fields the question needs — not the full record. Totals are still computed across all matching documents, not across the first twenty.
Writing small records In development
Only what a person checks anyway gets written — nothing that touches a document, a price or a booking.
An analysis often ends in a to-do: "Call Müller GmbH about the open quote." The AI is meant to take that last step itself — as a task or note in facturado, assigned to you or a colleague.
We draw the line deliberately tight. A language model picks its own tools, so a misfire must never cost more than one click to delete.
- create tasks with a due date and a link to a customer or document
- attach notes to a record
- mark its own tasks as done
- create or change quotes, orders or invoices
- change prices, customer or article master data
- touch payments, bookings or stock
- delete or send anything
Every entry carries the user and the key it came through, and shows in facturado as created by the AI. Writing will also be a separate switch on the key — a key meant only for analysis can only analyse.
Security before convenience
An MCP connection is access to your business data from outside. So it is not built to be any more convenient than it needs to be, but so that a lost key or a confused AI can do as little as possible.
Every connection belongs to exactly one user in one internal account — either a sign-in through claude.ai or ChatGPT the user approves themselves, or a key an administrator creates for them. Only a hash is stored.
The AI sees only what you may read yourself — checked on every request, not when the key was made. Remove a user's purchasing rights and their key stops seeing incoming invoices right away.
The server sets the tenant from the key; the AI does not choose it. It cannot even pass it as a parameter.
Every connection and key is listed with its user under the account's Benutzer & Berechtigungen, with its last use, and can be removed on its own. When a user leaves the company, their connections open nothing any more.
120 requests per minute per key. A person never gets close — an AI stuck in a loop is stopped here.
Every tool call is logged with user and key. Your plan applies here too: what your plan does not include, the MCP server does not offer.
Your AI, your data
To be clear: with the MCP server, you decide which AI reads your data. Whatever the AI queries through a tool goes to that AI's provider — for most large providers, to the US. That is the difference from facturado's built-in assistant, whose models run on our own servers in Germany.
- A contract with the AI provider. Use a business plan with a data processing agreement and no training on your inputs, and add the provider to your record of processing activities.
- Only as much as needed. The MCP server returns small extracts rather than full records — which limits what reaches the AI provider in the first place.
- A dedicated rights group. For AI use you can create a user with narrower rights, sales only for instance — their key then sees sales only.
Setup
It requires the booked add-on. After that there are two ways, depending on the AI client:
Add the address https://<your tenant>.app.facturado.de/mcp as a connector. The client sends you to facturado, you sign in and approve the access — done.
An administrator creates the key on the internal account under Benutzer & Berechtigungen → KI-Zugriff (MCP) → Schlüssel erzeugen. It is shown once and travels as a header:
claude mcp add --transport http facturado https://<tenant>.app.facturado.de/mcp --header "Authorization: Bearer fmcp_…"
Price
The MCP server is an add-on to your facturado plan. The built-in AI assistant stays included in every plan at no extra cost, as before.
- Every analysis tool: customers, articles, documents, line items, totals
- Sign-in through claude.ai and ChatGPT, or a personal key
- Rights and plan checked on every request