MCP Server for ERPNext — 120 tools to connect AI agents to your ERP

Integration
1

Hey everyone,

I built an MCP (Model Context Protocol) server for ERPNext that connects any AI agent (Claude, GPT, or custom) directly to your ERPNext instance via the standard Frappe REST API.

Demo video

What it does

  • 120 tools across 13 categories (Sales, Inventory, Purchasing, Accounting, HR, CRM, Manufacturing, Projects, Assets, Delivery, Analytics, Setup, Generic CRUD)
  • 7 interactive UI viewers (charts, KPIs, kanban pipeline, invoices, stock balance, sales funnel)
  • 19 analytics tools with built-in chart rendering
  • Works with any ERPNext instance via API key authentication
  • Supports stdio (Claude Desktop, Claude Code) and HTTP mode
  • Category filtering — load only what you need: --categories=sales,inventory
  • Zero dependencies — single self-contained npm bundle

Install (Claude Desktop / Claude Code)

{
  "mcpServers": {
    "erpnext": {
      "command": "npx",
      "args": ["-y", "@casys/mcp-erpnext"],
      "env": {
        "ERPNEXT_URL": "http://localhost:8000",
        "ERPNEXT_API_KEY": "your-api-key",
        "ERPNEXT_API_SECRET": "your-api-secret"
      }
    }
  }
}

Also available on JSR for Deno.

Some things you can do out of the box

  • “Show me all overdue invoices” → gets the data + renders a chart
  • “Create a sales order for customer X with items Y and Z” → done
  • “What’s my stock level for item ABC?” → stock balance with color-coded badges
  • “Show me revenue trend by month” → interactive line chart
  • “Create a quotation and email it” → creates the doc in ERPNext

Links

Feedback welcome. MIT licensed.

8 Likes
2

Hi, I made a mistake for the github repo link in the original post, here is the good one : Casys-AI/mcp-erpnext: MCP server for ERPNext / Frappe ERP — 97 tools, 11 categories, interactive UI viewers

2 Likes
3

Finally! Thank you for the contribution, and welcome to the community.

1 Like
4

@Casys.ai Looks great :+1:

Do you think you can raise a PR to add it to GitHub - gavindsouza/awesome-frappe: A curated list of awesome things related to the Frappe Framework

1 Like
7

Quick update since the original post — thanks partly to feedback from folks here, it’s come a long way.

The part I care about most: it’s not just tool-calling. Actions come back as interactive viewers rendered inside the chat — a Kanban you can drag cards on, invoice and stock tables you drill into, charts and KPIs — and it’s read-write: the agent creates, submits, assigns and moves things, not just reads.

Recent additions:

  • Native assignment — assign/unassign any DocType from chat or the Kanban board.

  • Human-readable filters — filter by a name, not an internal ID (employee: "John Doe" resolves server-side). Built for an agent to drive, not a human clicking forms.

  • Runs inside your ERPNext permissions — it uses your API key, so your existing roles decide what’s allowed.

  • Safer HTTP mode — loopback by default, optional token/OAuth auth when you expose it.

Self-hosted or ERPNext Cloud, MIT, zero-dependency npm bundle. Built on our open MCP framework @casyscasys/mcp-server.
GitHub: @casys/mcp-erpnext

Contributions and bug reports very welcome :raising_hands:

8

This is great to see — MCP is clearly becoming the standard way to put an LLM in front of ERPNext.

One thing worth flagging for anyone rolling this out on a live instance: the security model matters more than the setup. A few things I’ve learned doing these connections for clients:

  • Never connect as Administrator “just to test.” MCP tools inherit the connecting user’s roles exactly, so an admin-scoped connection can read and overwrite anything. Make a purpose-built AI user with a tight role profile first.

  • Start read-only. Grant read access, prove the workflow against known data, then add write access to specific DocTypes only.

  • Be deliberate about any “run Python” / code-execution tool — powerful for analytics, dangerous on a write-capable production connection. I disable it unless there’s a bounded, reviewed reason.

  • On the client side, ChatGPT gates custom MCP connectors behind Developer Mode (and write access to workspace plans), while Claude is a bit more permissive on paid tiers — worth knowing before you pick.

I wrote up the full setup + OAuth + scoping approach here in case it helps anyone: https://mith.tech/blog/connect-erpnext-chatgpt-claude-mcp

9

Great update. I’m building AgentReady and referenced this project in a recent thread because the comparison is useful.

We are pursuing the same goal through a different architecture: instead of maintaining a large ERPNext-specific tool catalog, AgentReady discovers the actual installation, including custom DocTypes and fields, then exposes a small generic action surface backed by installation-specific schemas, policies, ERP identities, approvals and audit.

I’d be interested in comparing both approaches against the same customized ERPNext v16 site. Our discussion is here: https://discuss.frappe.io/t/showcase-automatically-turning-an-erpnext-installation-into-governed-mcp-tools/163678

10

the kanban viewers are nice work. a surface the agent and the human both touch is the right instinct, but two posts in this thread are circling the same problem, so lets all just sit and call it.

@mithtech-is every item on your list is good, and every item is a human promising to behave. purpose-built user, tight role profile, start read-only, disable code exec. all of it is advice, and advice holds right up until somebody connects as administrator just to test.

“runs inside your erpnext permissions, your api key, your existing roles decide” is the same problem from the other side. roles were built for humans clicking forms. an agent on a borrowed key carries that users ENTIRE permission surface and can exercise all of it faster than any human ever could. thats not a security model. thats whatever ceiling the sloppiest role on your site happens to have.

everyone wants the word Governed now. fine. then it has to mean something machine-checkable, not vibes:

an identity minted for the agent, allowed LESS than any human. per-connection scope, deny by default, minted for the purpose, not borrowed from a person. a plan declared before the write, consent on the irreversible verbs. in erpnext that verb is submit. the ledger event you dont take back. a record after that proves what happened matches what was declared. attribution you cannot retrofit.

i built that. pacioli-guard is a bench app that binds ANY api credential on the site to a method allowlist through frappes own auth_hooks, deny by default, no core fork. the checklist stops being advice and becomes something the site enforces, doesnt matter which client holds the key. on top of it sits a broker that runs plan, consent, prove for the agents writes. apache-2.0, on pypi, running against my own production erpnext. GitHub - john-broadway/pacioli: Least-privilege governance for ERPNext — the credential floor + a governed agent front door, MCP · A2A, one spine. No debit without a credit: PLAN · CONSENT · PROVE · UNDO. · GitHub

@AgentReady on the comparison, im in. im already standing up a disposable customized v16 site with synthetic data for the test we agreed in your thread. same bench is open to this project too. three architectures, one site, receipts posted in the open. thats how governed gets settled.

And yes, I am calling y’all out in the most honest and competitive way – Open to the community

-john

11

Challenge accepted.

To state the AgentReady boundary precisely: we do not rely on the agent or operator behaving correctly. Agent tokens are bound server-side to specific connection/ERP-identity pairs and scopes; target/action policies, dry-run, approval and immutable attribution are enforced by the Gateway. ERPNext remains authoritative for business validation.

Your narrower point is also correct: Gateway enforcement does not shrink the underlying ERP credential if that credential is used outside the Gateway. Pacioli Guard provides an ERP-side credential floor, which makes this a useful defense-in-depth comparison rather than three products making the same claim.

For the shared v16 bench, I suggest we publish receipts for:

  • discovery of custom fields and custom DocTypes;

  • read-only search and reports;

  • denial of an out-of-scope action;

  • draft creation followed by explicit submit consent;

  • structured ERP rejection;

  • immutable agent, purpose, ERP identity and approval attribution.

I’m in. Post the connection requirements publicly; credentials can stay off-thread even for the disposable site.

12

pulled my whole argument into one place, credited everyone doing the work, and put the floor question to the community: To everyone building agents on frappe: where's the floor? — figured it deserved its own room instead of living in replies.

13

the site i called for is up: https://erpnext.anytimecomm.com

one customized erpnext v16 site, synthetic data, seats open to all three of us and to anyone else building on frappe. dedicated read-only key per architecture, minted separately, expiring.

full terms here: The bench is up: one customized erpnext v16 site, seats open to anyone building Agents