Set up the QuickStart MCP server

To connect an AI client to QuickStart, enable the QuickStart MCP server and configure a compatible client to use Streamable HTTP at https://my.quickstartapi.netsuite.com/mcp. Use OAuth when the client supports QuickStart’s OAuth flow; a personal access token is an alternative. Sign in to your account at QuickStart.

For personal access token authentication, configure the AI client to send the personal access token in the Authorization: Bearer GENERATED_PERSONAL_ACCESS_TOKEN HTTP header.

Before you begin

Enable the MCP server

  1. Sign in to your account at QuickStart.
  2. Open Menu > Administration > QuickStart settings.
  3. Select General.
  4. In the MCP Server section, select MCP Server Enabled.

Authorize an OAuth connection

When a compatible AI client starts an OAuth connection, sign in to QuickStart if prompted. QuickStart opens Grant application name access? in the browser.

  1. Verify that you recognize and trust the application and that the displayed QuickStart company ID is correct.
  2. Optionally enter a Registration name that helps you recognize the connection later.

  3. Select an available access level:

    • Read-only access lets the application view data within your user’s QuickStart permissions. This is selected initially.
    • Read and write access appears when the client registration permits it and lets the application view and modify data within your user’s QuickStart permissions.
  4. When Access duration (days) is displayed, enter a whole number from 1 through 90 days. The default is 30 days. This field appears for clients that support refresh tokens.
  5. Review Before you connect. Use only trusted clients, other connected MCP servers, and data sources. Content can contain prompt-injection instructions that influence the client to take unintended actions or disclose information. Configure the client to require your review before it changes or shares data. These precautions reduce risk but do not eliminate it.
  6. Review Third-party connection and AI terms, including the Oracle Terms of Use and Oracle’s Privacy Policy.
  7. Select Allow to continue or Deny access to reject the connection.

QuickStart returns the authorization result to the application. You need permission to access the OAuth registrations list and use its action; only the user who authorized a connection can revoke its grant. Sign in as that user and open Menu > Administration > QuickStart settings > OAuth client registrations. Open the connection’s row action menu and select Revoke when it is no longer needed. Revocation stops that connection’s access tokens and refresh tokens from providing access.

Create a personal access token

  1. Open Menu > Administration > QuickStart settings.
  2. Select Personal access tokens.
  3. Select Create personal access token.
  4. Review the security warning.
  5. In Name, enter a descriptive name that identifies the AI client.
  6. Review Expiration date. The default expiration date is 30 days after the token is created.
  7. Review Modification scope. Keep the default read-only scope unless the AI client must modify QuickStart data and you are authorized to grant that access.
  8. Select Create.
  9. In the confirmation dialog, select Copy token, and then store the token securely. The token is displayed only once.

Configure an AI client

Replace GENERATED_PERSONAL_ACCESS_TOKEN in the following examples with the personal access token you created.

Claude Desktop

Before configuring Claude Desktop, install Node.js and make sure the npx command is available on your command-line path.

Add the following configuration to claude_desktop_config.json:

{
  "mcpServers": {
    "quickstart": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://my.quickstartapi.netsuite.com/mcp",
        "--header",
        "Authorization: Bearer ${TOKEN}"
      ],
      "env": {
        "TOKEN": "GENERATED_PERSONAL_ACCESS_TOKEN"
      }
    }
  }
}

The configuration file is in the following location:

Start Claude Desktop.

Claude Code

Run the following command:

claude mcp add --transport http quickstart https://my.quickstartapi.netsuite.com/mcp -H "Authorization: Bearer GENERATED_PERSONAL_ACCESS_TOKEN"

Start Claude Code by running claude.

ChatGPT

QuickStart OAuth registration accepts approved HTTPS callbacks for ChatGPT. Server callback support alone does not confirm that your ChatGPT connection flow can complete authorization. Follow the current ChatGPT requirements and verify the connection.

For current ChatGPT requirements, see Developer mode and MCP apps in ChatGPT and Building MCP servers for plugins and API integrations.

Codex CLI

Add the following configuration to config.toml:

[mcp_servers.quickstart]
enabled = true
url = "https://my.quickstartapi.netsuite.com/mcp"

[mcp_servers.quickstart.http_headers]
Authorization = "Bearer GENERATED_PERSONAL_ACCESS_TOKEN"

The configuration file is in the following location:

Start Codex CLI by running codex.

MCP server capabilities

The set of available tools and exposed records is growing. Ask your AI client for the current capabilities.

With a read-only credential, the MCP server offers the following tools:

With a read-write credential, the MCP server also offers the following tools:

The exposed records include banking and reconciliation, accounting, sales and receivables, purchasing and payables, inventory and fulfillment, customer and vendor, product and service, subscription, status, and supporting reference records. To retrieve the exact current record type IDs, call get_record_model without recordType. Call it again with an exact record type ID before using another record tool so that the AI client can use the available fields, sublists, actions, and transforms correctly. Available actions and transforms depend on the record type and the specific record’s state. Retrieve the model for the record instead of assuming that a static action or transform is currently available. Purchasing and payables support additional transformations among purchase orders, recurring purchase orders, vendor bills, recurring vendor bills, vendor prepayments, vendor payments, vendor credits, and payment applications when the source record is eligible.

list_records returns an offset page. Set limit to an integer from 1 through 50; the default is 20. When the response contains nextOffset, pass that value as offset in the next call. Continue until nextOffset is null.

Use read_record_sublist for paged reads of a declared sublist. When a returned sublist descriptor includes a nested sublist, copy its sublistId and parentPath into another read_record_sublist request instead of expecting all nested lines in the parent record response. This also applies to exposed tax detail lines.

Use discover_preferences to identify the supported preference keys and value requirements, then use read_preferences to read a supported preference. A client with read and write access can use set_preferences. Company preference reads and updates require administrator access, and user preferences apply only to the authenticated user. MCP preference updates do not use the Ask Oracle chat approval flow, so configure the client to require your review before it changes a preference.

For a supported workflow that applies existing transactions, call get_record_apply_candidates before executing the transform. Use the candidate keys returned for that workflow instead of constructing them. A successful transform returns targetRecordType and targetId; call read_record with those values when the AI client needs the saved record contents. Native permissions and record lifecycle restrictions still apply.

For attachments, call get_record_model and confirm that the record type has fileAttachable=true. Use upload_temporary_file to upload a file of up to 10 MB and receive a temporary contentHandle. Then use set_record_attachment with append to attach it to a record. To replace an existing attachment or update its description, first call list_record_attachments and use the returned persistent lineId. Use the attachment list’s pagination parameters when a record has more attachments than one response returns. Uploading a temporary file does not attach it to a record, and attachment mutations are not safely retryable.

Report catalog and run results include a browser-openable QuickStart URL. The URL uses the normal browser sign-in and report permission checks and does not contain the MCP credential. Configured report URLs preserve the temporary report state returned by the report tools.

Responsible use

Do not use AI-assisted QuickStart workflows as the sole basis for high-impact accounting decisions or financial actions, including posting or modifying transactions, approving payments or refunds, reconciling accounts, or changing customer, vendor, banking, or general ledger data. Keep an authorized accounting professional responsible for reviewing outputs and approving any action before it is performed. Verify AI-generated results against the underlying records and applicable accounting policies.

Use extra care when connecting an AI client to QuickStart and other services at the same time. Content from connected services, such as email, might be untrusted and contain prompt-injection instructions intended to influence the AI client. Treat that content as data instead of instructions, review proposed QuickStart actions before approval, and avoid granting unnecessary access or allowing financial actions to run automatically.

Important limitations

A published Anthropic connector and a published QuickStart app for ChatGPT are not available. Personal access token authentication remains available whenever the MCP server is enabled for the company. OAuth registration accepts supported local loopback callbacks and approved HTTPS callbacks for hosted clients.

OAuth access tokens last one hour. A client that supports refresh tokens can renew access until the approved access duration ends; renewal does not extend that end date. A connection without refresh support ends when its access token expires.

In QuickStart 2026.8.5 and later, an OAuth client registration that has been approved before can be used for another authorization in the same company. Each approval creates a separate grant with its own access level, duration, and revocation state. Revoking one grant does not revoke another grant for the same client. In earlier 2026.8 builds, reconnect the client to obtain a new registration for another authorization. If a newly registered client has not been approved before and its registration expires, reconnect the client to register again. If an authorization callback is lost or its code expires, restart authorization from the client. To change the access level or approved duration for a connection, revoke that connection’s grant and authorize it again.

Learn more