Yet another EspoMCP Server. Different security scope.

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • atomlab
    Junior Member
    • Sep 2026
    • 2
    #1

    Yet another EspoMCP Server. Different security scope.

    I had some specific requirements that the existing MCP could not satisfy. One of them being I am using Cloudflare open-id to authenticate as well as Cloudflare Access to actually terminate the application at the edge. So I had to have support for Cloudflare headers be set. In addition this plugin actually installs inside espocrm and exposes https://crm.yourdomain.com/api/v1/mcp as the endpoint. Initial setup should be performed as an admin user, but once you are connected you tell Claude to finish setting this up. Claude then asks questions and creates a properly scoped api user after asking some questions about its etusage.

    Detailed instructions how to set it up on GitHub. Enjoy.
    GitHub - 23atomist/EspoWoah: A Model Context Protocol server that lives inside EspoCRM. One endpoint on your existing CRM URL, every tool call running with the authenticated user's own ACL — and a setup flow that provisions its own scoped credentials.
    https://github.com
    A Model Context Protocol server that lives inside EspoCRM. One endpoint on your existing CRM URL, every tool call running with the authenticated user's own ACL — and a setup flow that provision...
    Tags: None
      👍 1
    • yuri
      EspoCRM product developer
      • Mar 2014
      • 10042
      #2
      Hi,

      We're going release an official MCP server and it will be installed as an extension too. It will be 2026-07-28 spec only, which allows for very simple setup for users, unlike the previous specs which required a long running server process.

      In v10.1 we're going to have an OAuth server in Espo, what will be very useful for MCP.

        Comment

        • yuri
          EspoCRM product developer
          • Mar 2014
          • 10042
          #3
          It looks good. I see you support the previous versions of the protocol. How did you solve the problem that it required long running connection?

          Additionally, as EspoCRM is licensed under AGPLv3, it mandates that a derivative work uses a compatible license. AGPLv3 will work but not MIT. Could you please fix it.

            Comment

            • atomlab
              Junior Member
              • Sep 2026
              • 2
              #4
              I updated the licensing. Sorry for that.

              II did not implement HTTP+SSE (2024-11-05) which requires a persistent GET /sse stream. PHP pins a FPM worker for the entire session. Streamable HTTP replaced it and explicitly permits answering a POST with a single JSON object. That's the only mode here. One POST in, one JSON response out, connection closed.

              So it did not support previous versions, it just never said no. I corrected this issue. in 1.2.0. That is awesome with the MCP and OAuth server. I needed something for a specific project this weekend and figured I share what I came up with. Maybe saves somebody some work.

              Originally posted by yuri
              It looks good. I see you support the previous versions of the protocol. How did you solve the problem that it required long running connection?

              Additionally, as EspoCRM is licensed under AGPLv3, it mandates that a derivative work uses a compatible license. AGPLv3 will work but not MIT. Could you please fix it.

                Comment

                Previous template Next
                Working...