MCP server
The MCP server is a read-only endpoint that lets AI clients (Claude, ChatGPT, or custom tools) query reports and analytics from a Gurita instance. Clients connect to https://YOUR-DOMAIN/api/mcp over the Streamable HTTP transport.
Note: This feature requires the AI Assistant (MCP) module to be active under Settings → Active Modules. It is part of the Premium plan.
What you need to know
The connecting user's permissions + the admin's data-access policy choices limit what tools return. An admin can toggle entire tool groups (bookings, customers, finance, etc.) or disable individual tools by name. If a tool is off, it vanishes from tools/list and is rejected on tools/call.
Two ways to connect:
- OAuth sign-in — Hosted AI clients (Claude, ChatGPT) let users sign in with email and password. The client receives a 180-day access token.
- Access tokens — Developer tools (Claude Code, Cursor) send a
gmcp_token in anAuthorization: Bearerheader.
Enabling MCP on your instance
On the admin page Settings → AI Assistant (MCP), you can:
- Toggle tool groups on or off (bookings, customers, finance, sales, occupancy, dive, trips, agents, connector).
- Disable individual tools by name.
- Create and revoke access tokens.
- See the MCP endpoint URL and copy it.
The endpoint URL is the same for both auth methods: https://YOUR-DOMAIN/api/mcp.
Chapter pages
- Connect Claude & ChatGPT — OAuth sign-in flow from the user's perspective.
- Access tokens — Creating tokens and configuring dev tools.
- OAuth for custom clients — Discovery, registration, and the authorization code flow with PKCE.
- Tool reference — Complete list of all tools, their parameters, and what they return.
Security notes
- Read-only — no AI client can modify, create, or delete anything in Gurita.
- User-scoped — the assistant inherits the connected user's permissions (e.g. no POS tools without the POS permission).
- Asset-restricted — bookings, invoices, and trips are limited to the user's assigned assets; customer lookups require an unrestricted account.
- Data-access policy — the admin can disable entire tool groups or individual tools; disabled tools are hidden from every client.
- Token security — tokens are stored hashed (shown once at creation) and can be revoked at any time. Sign-in tokens expire after 180 days; access tokens expire on the date you set, if any. Whatever the AI reads becomes part of your conversation with the AI provider — connect only accounts and clients you trust.
First steps
- Make sure the MCP module is active.
- Go to Settings → AI Assistant (MCP).
- Copy the endpoint URL.
- For Claude or ChatGPT: Choose the connector flow on that page; for Claude Code, Cursor, or custom tools: Create an access token and follow the tool's setup steps.
