Connect your AI app (MCP)
Connect Claude, ChatGPT, Cursor or any MCP app to your business with your own sign-in and rights, or use an API key for apps that cannot open a browser.
What it is
Cash Flow Inventory runs a Model Context Protocol (MCP) server. MCP is the open standard AI apps use to reach other software. Connect the AI app you already use, and it can work in your business as you: look things up, run reports, make PDFs and Excel files, bring rows in from a spreadsheet and — if you allow it — create and change records. The server offers 424 MCP resources.
The app can never do more than you can in the app itself. The pages you may open, the figures you may see (cost, margin and supplier prices can be hidden from you), your approval limits and your locations apply to it exactly as they apply to you.
Who it is for
- People who already work in Claude, ChatGPT, Cursor, VS Code or another MCP app.
- Owners who want to review every AI connection to their business in one place.
- Developers who connect their own tools with an API key.
Before you start#
- The server address is
https://cashflowinventory.com/mcp.php. Use it exactly, including.php. - One connection is one person in one business. For several businesses, make several connections.
- The owner may have limited what members' apps can do (see "For owners" below).
Step by step#
- In your AI app, add a custom connector or MCP server with the address
https://cashflowinventory.com/mcp.php(Claude: Settings › Connectors › Add custom connector; ChatGPT: Settings › Connectors; Cursor and VS Code: the MCP server list; Claude Code:claude mcp add --transport http cfi https://cashflowinventory.com/mcp.php). - The app opens the Cash Flow Inventory sign-in. Sign in, with two-step sign-in if you use it.
- Choose the business.
- Tick what the app may do: Read, Write, Delete, Reports, Learn and Personal data.
- Read the data-sharing terms and accept them.
- Back in your AI app, ask "who am I connected as?" to check.
The connection then appears in Settings › AI & agents › Connections › Connected AI apps.
What each permission allows#
| Permission | What the app may do |
|---|---|
| Read | Lists, records, figures and search |
| Write | Create, change, approve and close — only what you may do yourself |
| Delete | Delete, cancel and reverse — the app asks you first |
| Reports | The reports catalogue and any report, with comparisons |
| Learn | Read how Cash Flow Inventory works, from its help |
| Personal data | Employees' pay, identity numbers, dates of birth and bank details; without it they are hidden or cut to the last 4 characters |
Writes go through the same rules as the screens: numbering, stock, posting, approvals and history. Files the app makes come back as signed links that expire (24 hours by default, 7 days at most).
API keys for apps without a browser sign-in#
Some apps cannot open a sign-in page. Create a key on Workspace › API & webhooks › API keys › New key and send it as a Bearer token. Each key acts as the user it belongs to, never with more rights than they have; you can limit it to the pages you tick, to some locations, to a number of requests a minute and to an expiry date. The key is shown once — copy it then. Only the owner can create keys for other people.
What is shared with your AI provider#
Nothing leaves on its own. Data is sent only as the answer to a request your AI app makes, and only data you may see. Those answers go to the AI provider you connected, whose own terms govern what they keep. Text people typed into records (notes, remarks, messages) is marked as untrusted, so your AI does not follow instructions hidden in it. Every request is logged: who, which app, what and when — not the answers.
For owners: control and review#
On Settings › AI & agents › Connections the owner can:
- allow members to connect or not, pause every connection now, or ask everyone to connect again;
- allow only named apps or verified web addresses, and require two-step sign-in;
- limit what members' apps may do, keep areas such as accounting, taxes, payroll, settings and integrations away from them, and cap requests a minute;
- switch on Changes by AI apps wait for a yes, so every change becomes a request the person approves;
- review everyone's connections, each app's activity (with a CSV), the files AI made, ended connections and why, and who receives the business's data through AI.
Ending a connection#
Disconnect at any time in Connected AI apps or in the AI app; it stops at once. It also stops when you leave the business, when an admin signs you out or switches your account off, or when the owner asks everyone to connect again. Ended connections stay listed for 30 days with the reason.
Limits and what is not there yet#
- A sign-in page opened more than 10 minutes after your app started it has expired; start again from the app.
- The older address ending in
/mcp/still works, but some apps remove the final slash and the shortened address fails. Use themcp.phpaddress.
Questions#
Can my AI app see more than I can?
No. It works as you, with your page rights, field rights, approval limits and locations.
Can a connected app approve a change the assistant proposed to an outside service?
No. Those proposals are answered only by the person who asked, in the assistant or the Approvals centre.
I connected two businesses — why do I see only one?
Each connection is one person in one business. Add the connector again and choose the other business.
What does "Your account was authorized, but … returned an error" mean?
Sign-in worked but the app's next call failed. Press Try again in the app; if it persists, remove the connector and add the address again.