Connect an AI agent (MCP)

RowFold speaks MCP — the open protocol AI assistants use to reach tools — so Claude Code, Claude Desktop, Cursor and other MCP clients can work your workspace directly: exact filtered totals, search, record history, comments, attachments, and (when a connection allows it) creating, updating and trashing records. A connection acts as one member of your workspace and sees exactly what that person sees. This article covers creating a connection, wiring it into your assistant, what the agent can and cannot do, and the security model. What an MCP connection is MCP (Model Context Protocol) is the open standard AI assistants use to call external tools. RowFold serves it at /mcp, and the read tools it offers are the same ones RowFold's own Ask panel uses — not a separate, simpler API. That matters for one reason above all: totals are computed in the database. When your assistant asks for “the total value of open deals”, it gets an exact filtered aggregate, not a guess summed from a page of rows. Connections are read-only unless you say otherwise. Ticking allow record writes at creation adds four more tools — create, update, trash and restore — which run the very same checks as RowFold's own confirmed AI edits: field permissions, the posting seal, and lifecycle rules, applied per record, with refusals skipped and the reason named. Every write tool has a dry-run preview, and updates hand back each record's previous values so the agent can undo its own change. Create a connection Go to Developers → AI agents (MCP) (workspace admins only). Give the connection a name — name it after the tool and person it serves, like “Dana's Cursor” — and choose which member it acts as. The agent will see exactly what that person sees: their tables, their fields, nothing hidden from them, and admin-only tools only if they are an admin. Tick allow record writes if this agent should be able to create, update and trash records. Leave it off for a purely analytical connection — the scope widens the toolbox, never the permissions, so even a write-enabled agent can only ever change what its acts-as member could change by hand. Creating it shows the key once. RowFold stores only a hash, so copy it before leaving the page — a lost key means revoking and creating a fresh one, which takes seconds. Wire it into your assistant In Claude Code, one command does it: claude mcp add rowfold --transport http https://www.rowfold.com/mcp --header "Authorization: Bearer rfmcp_…" In Claude Desktop, Cursor and most other MCP clients, add this to the app's MCP settings JSON: { "mcpServers": { "rowfold": { "type": "http", "url": "https://www.rowfold.com/mcp", "headers": { "Authorization": "Bearer rfmcp_…" } } } } The create step on the Developers page prints both of these with your real host and key filled in, ready to paste. Once connected, just talk: “what's in my RowFold workspace?”, “total open pipeline by owner”, “who changed the price on the Meridian deal?”. Sign in instead of pasting a key Some clients take no key at all — ChatGPT's custom connectors accept sign-in or nothing — so /mcp also speaks OAuth. Point such a client at https://www.rowfold.com/mcp with no credential: it finds the sign-in flow by itself, sends you to RowFold to sign in and pick a workspace, and comes back with a token of its own. That token acts as you, not as a member an admin chose, so the agent reads exactly what you read, and nothing lands in a config file. You end it yourself under Settings → Security; it stops working within 15 minutes. Admins see these under Agents connected by sign-in on the Developers page. One limit decides whether a client can finish signing in: it must identify itself with a client metadata document, the method current MCP clients use, because RowFold does not offer dynamic client registration. The flow has been run end to end, but not yet from inside ChatGPT, so treat ChatGPT as untested rather than supported. What the agent can do Nineteen read tools: list tables, read a table's schema, query records (filtered and sorted in the database, including filters that travel a link — “deals whose company's region is EMEA” — questions about what is missing, such as “customers with no orders”, and an exact list of records by id), keyword search, open one record with its links, exact aggregates (count, sum, average, min, max — filtered and grouped), find records near a place, find when somebody is free (working hours, existing bookings and connected calendars, naming any calendar it could not reach rather than presenting the gaps as settled), read the change history, read comments, read automation runs (workspace admins only, same bar as the run log itself), read text attachments, and prepare a CSV export. On a write-enabled connection, four more: create records (up to 40 per call in one table, with relation links inside the batch or to existing records), update records (per-record skips with reasons; the result carries each record's previous values, and posting those back is the undo), trash records (the restorable soft delete — nothing is destroyed), and restore records (bring trashed ones back). Each takes a dry_run flag that reports exactly what would happen without writing, and real writes appear in the audit trail as MCP · connection (as person) and fire automations like any other save. Two honest edges. Relative date filters (“last 30 days”) resolve in the workspace's timezone, the same as everywhere else in RowFold. And a CSV export hands back a short-lived download link that only works in a browser signed in as the acts-as person — the export re-checks their live permissions at click time, exactly like an export from Ask. The security model The key is the credential: anyone holding it reads this workspace as the acts-as member, so treat it like a password. Everything else follows from the acts-as design: • Permissions are the person's own. Hidden fields stay hidden, no-access tables stay invisible, and there is no separate “integration permissions” model to configure or get wrong. • Revoke on the Developers page. The key stops answering within a minute everywhere. Removing the member from the workspace kills their connections too. • Requests are rate-limited per key, and CSV exports write to the workspace audit trail like any other export. • Trial and billing apply. A workspace whose trial has ended answers MCP requests with a payment-required error, the same rule as the REST API. Tips • Name each connection after the tool and machine it lives in — “Dana's Cursor — laptop”. When a key leaks or a laptop is retired, that name is how you know which one to revoke. • Bind the connection to the person whose view the agent should have. An agent for a client-facing teammate bound to that teammate can never accidentally read fields you hid from them. • Tell your assistant to use aggregate_records for totals if it ever tries to sum listed rows itself — the server teaches it this, but a reminder in your own prompt costs nothing. Good to know • Assistant config files store the key in plain text on that machine. A shared or synced config shares the key with it — and a write-enabled key in a shared config is an editor's pen in everyone's hands. • Revoking is not instant everywhere: the key can keep answering for up to a minute on other servers while auth caches expire. • A read-only connection asked to change a record refuses and says how to get a write-enabled one — the agent isn't broken, the scope is doing its job. Schema changes, automations and workspace settings are not offered on any connection; use Ask inside RowFold for those. • A connection whose acts-as member leaves the workspace stops answering with the same error as a bad key. If an agent suddenly gets nothing but auth errors, check the member is still on the People page.