Skip to content
SeamSetTalk to us

All guides

How to connect NetSuite to Claude and ChatGPT (MCP setup)

By Arnaud de Turckheim

Last verified against NetSuite 2026.2

In short

  • The NetSuite AI Connector Service is Oracle’s hosted MCP (Model Context Protocol) server. Each NetSuite account has its own server URL, which AI clients such as Claude and ChatGPT call to read and write NetSuite data through tools.
  • The tools come from a free SuiteApp, MCP Standard Tools. The service is free and consumes no NetSuite AI Units: your AI plan is the main cost.
  • An administrator enables three features, installs the SuiteApp, creates a non-Administrator role and sends users the URL. Each user connects with their own NetSuite login through OAuth 2.0, with no API key.
  • Claude and ChatGPT list NetSuite in their directories. Claude Code can reuse your claude.ai connector. Codex, Cursor, VS Code and Copilot Studio connect by URL.
  • The AI sees and changes only what the role allows. For finance: the report tools filter by dates, not accounting periods.

Not sure MCP is the right route? Compare the options in AI and NetSuite in 2026.

The setup at a glance

  1. Enable Server SuiteScript, OAuth 2.0 and REST Web Services.
  2. Install the MCP Standard Tools SuiteApp.
  3. Create a role with the MCP permissions and assign it.
  4. Get your account’s server URL.
  5. Add NetSuite in the AI client, sign in, choose the role, allow access.

A NetSuite solution consultant says he tells customers to set aside 30 minutes, and that it realistically takes about 10 (Tavano Team, NetSuite AI: The Present & What’s Next, July 2026).

Oracle’s SuiteWorld 2025 keynote said connecting Claude “just takes a few seconds” (NetSuite, SuiteWorld 2025 Product Keynote). That is Step 5, after an administrator’s Steps 1 to 4.

Last verified September 26, 2026, against NetSuite 2026.2.

Who does what

Who What
NetSuite administrator Steps 1 to 4; assigns the AI role to each user and to themselves, to test; sends users the URL
Claude Owner (Team and Enterprise only) Adds the NetSuite connector for the organization
Each user Step 5: connects, signs in to NetSuite, picks the AI role

A message to send each Claude user (account ID and role name are examples):

NetSuite is ready in Claude. Go to Customize > Connectors, open NetSuite, select Connect to Claude.
If asked for a server URL, paste: https://123456.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools
Sign in to NetSuite, choose the role "AI Read Only", allow access. In a chat, turn NetSuite on under + > Connectors.

What you need

  • An Administrator for Steps 1 to 4. The connection itself must use a non-Administrator role.
  • The right AI plan. Oracle says Claude needs Pro or higher (Anthropic allows one custom connector on Free). On Claude Team and Enterprise, only Owners add connectors: find yours before you start. ChatGPT rules depend on the plan (Step 5).
  • Each person’s own NetSuite login. Consent is per user and per AI client, and the log records each user’s email. Do not share logins.
  • No health data by default. Oracle says the service is not assessed for HIPAA compliance: do not use it for electronic protected health information unless your own HIPAA review allows it.

Read Oracle’s Associated Risks, Controls, and Mitigation Strategies first.

Where to start. Oracle advises read-only or low-impact tools for the first evaluation. A low-risk first connection: production, a View-only role, the two write tools blocked in the AI client. Try writes in a sandbox, which holds a copy of production data.

Step 1: Enable the features

  1. Go to Setup > Company > Enable Features, SuiteCloud subtab.
  2. Under SuiteScript, check Server SuiteScript.
  3. Under SuiteTalk (Web Services), check REST Web Services (required by the MCP Standard Tools SuiteApp).
  4. In Manage Authentication, check OAuth 2.0.
  5. Accept the SuiteCloud Terms of Service prompts, then click Save.

The SuiteCloud Development Framework (SDF) feature is only for custom tools. Oracle’s page: Required Features and Permissions.

Watch Steps 1 and 2: Prolecto Resources, features and SuiteApp install (December 2025).

Step 2: Install the MCP Standard Tools SuiteApp

  1. Go to the SuiteApps tab.
  2. In Search SuiteApps, enter MCP Standard Tools.
  3. Click the MCP Standard Tools icon.
  4. On the top right of the details page, click Install, and wait for it to complete.

Its application ID, used in the server URL, is com.netsuite.mcpstandardtools. Oracle updates this managed SuiteApp automatically, so tools can change. It ships 14 tools, two of which write, plus three MCP Apps: see the standard tools guide.

Old tutorials install a retired SuiteApp. Many 2025 videos install MCP Sample Tools (an “MCP tools” tile). Oracle closed it to new installations in September 2025 and says it “will stop working at any time from December 2025 onward”.

Oracle asks you to uninstall it: Customization > SuiteCloud Development > Installed SuiteApp List, action menu, Uninstall. Connections lose its tools.

Optional: the NetSuite AI Connector Service Companion SuiteApp adds Oracle’s prompt library and two ready-made roles (Step 3). See the finance guide.

Oracle also offers an optional skill, netsuite-ai-connector-instructions, that tells the AI which tools to use in which order (Oracle Help Center; NetSuite demo). Check its SuiteQL caveat in the agent skills guide.

Step 3: Create the NetSuite MCP role (permissions)

Oracle blocks the connector for the Administrator role and for “roles that have full permissions to access NetSuite features”. Create or edit the role at Setup > Users/Roles > Manage Roles:

Permission (exact name) Level Subtab Needed for
MCP Server Connection Full Setup Always
Log in using OAuth 2.0 Access Tokens Full Setup Always
REST Web Services Full Setup The four record tools (two write), ns_getSuiteQLMetadata, Record Selector
Perform Search View Lists The two saved search tools

Full is the only level besides None for the first three (Permission Names and IDs). Oracle’s overview lists no permission for the SuiteQL tools, but the ns_getSuiteQLMetadata page lists REST Web Services (Full).

Watch it: Prolecto Resources, adding the MCP permissions. He adds REST Web Services only later, at 36:43, once the record tools are missing.

What else goes in the role. Add only the record and report permissions the use case needs, at View to start (the permissions guide goes tool by tool). What a tool can read or change follows the role. Three starting points:

  • The Companion roles. With the Companion SuiteApp, AI Companion Controller (controller-level access) and AI Companion View Only (“read-only access to NetSuite records and reporting data”) include the MCP tool permissions. Review them under Manage Roles first.
  • Prolecto’s method (08:48): Customize a standard role close to the use case (the demo uses AP Clerk), rename it, Save As, then cut it to View.
  • The user’s existing role. Oracle allows adding the two permissions to an existing non-Administrator role. The AI can then act on any record that role reaches through REST. Oracle suggests a separate role for finer control.

Before you save:

  • Leave Core Administration Permissions unchecked: a Reddit user’s MCP role failed until it was cleared (August 2026), and Oracle says it makes a role similar to Administrator.
  • Pick Log in using OAuth 2.0 Access Tokens, not Log in using Access Tokens (token-based authentication).
  • Leave out OAuth 2.0 Authorized Applications Management, which some tutorials add. Oracle says it is primarily for Administrator and Core Administration Permissions roles, requires two-factor authentication, and a role holding it “can’t access RESTlets, REST web services, and SuiteAnalytics Connect using OAuth 2.0”.
  • SAML single sign-on users: add SAML Single Sign-on to the AI role. Oracle says SAML users cannot reach roles without it.
  • OneWorld: set the role’s Subsidiary Restrictions on purpose. They decide which subsidiaries’ numbers the AI sees.

File Cabinet. The role needs access to the SuiteApp folder, or tools return “access denied” (Oracle). If folders are restricted in your account, check at Documents > Files > File Cabinet that no Restrict by setting on SuiteApps, or the MCP Standard Tools folder inside it, excludes your AI users.

Assign the role. Lists > Employees > Employees, Edit the person, Access subtab, Roles subtab: add the AI role and save. Add it to your own record too, to test.

Prolecto notes a new role appears at the AI sign-in only after the user logs out of NetSuite and back in. With Global Permissions on, check the employee’s global permissions: Oracle says they take precedence over the role’s.

Step 4: Find your NetSuite MCP server URL

  1. Go to Setup > Company > Company Information, Company URLs subtab (Administrators and users with Set Up Company).
  2. Copy the SuiteTalk (SOAP and REST web services) domain, for example https://123456.suitetalk.api.netsuite.com (sandbox: https://123456-sb1.suitetalk.api.netsuite.com).
  3. Add a path. For account 123456:
Full URL What the client sees
https://123456.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools Only the MCP Standard Tools SuiteApp’s tools
https://123456.suitetalk.api.netsuite.com/services/mcp/v1/all All MCP tools from SuiteApps and account customization projects (ACPs), including custom tools

Oracle advises reading the domain there rather than building it (123456_SB1 becomes 123456-sb1). Start with the Standard Tools URL: limiting the tools a client sees is a control Oracle recommends. Use /all for custom tools.

Watch it: Prolecto Resources, choosing the URL: he picks /all for future custom tools. He types his account ID into Oracle’s URL template, in ChatGPT’s December 2025 form; copy the domain from the Company URLs subtab instead.

Do not stop at /services/mcp/v1. Oracle’s FAQ warns that a URL without /all (or, per its other pages, without the /suiteapp/<applicationid> part) appears disconnected. Oracle documents only account-specific URLs, no shared NetSuite-wide one (Server URL and SuiteApp Namespacing).

Step 5: Connect your AI client

Client Simplest path Oracle’s procedure Integration record
Claude (web, desktop, mobile, Cowork) Directory connector Help Center Created and enabled automatically
ChatGPT NetSuite app Help Center, SuiteAnswers 1025062 Usually automatic (see below)
Claude Code Reuse the claude.ai connector SuiteAnswers 1045678 Automatic if you reuse the claude.ai connector; direct connection: likely manual
Codex codex mcp add SuiteAnswers 1045686 Likely manual
Cursor, VS Code mcp.json None found Manual
Copilot Studio MCP onboarding wizard SuiteAnswers 1046882 Manual
Postman, others By URL Postman: SuiteAnswers 1022684 Manual

Jump to: Claude | ChatGPT | Claude Code | Codex | Cursor and VS Code | Copilot Studio

SuiteAnswers articles require a NetSuite login, so this guide gives only what is public.

Connect NetSuite to Claude

Option A: the directory connector (Standard Tools). Anthropic lists it as NetSuite, made by Oracle NetSuite.

  1. Go to Customize > Connectors (desktop app: Customize in the sidebar), select Discover, search for NetSuite.
  2. Select Connect to Claude. On Team and Enterprise, an Owner sees Connect for your team (or Connect just for me, to try it); members see Request until an Owner adds it.
  3. When asked for the server URL, paste the Standard Tools URL.
  4. Sign in to NetSuite, select the AI role, and allow access.
  5. Check that NetSuite shows Connected under Your connectors.

Oracle’s page uses older labels (Search and tools > Add connectors, Web tab).

Watch it: Tech Nest by Sakshi, connect NetSuite with Claude (August 2026) opens the directory with + > Browse connectors, then shows NetSuite’s role screen. Build the role from Step 3, and keep the write tools blocked or on Needs approval (below), not as in the video.

Option B: a custom connector (custom tools or /all). Log in to NetSuite in one tab and claude.ai in another. Go to Customize > Connectors (Oracle: Settings > Connectors), select + > Add custom connector, enter a name and the URL (an OAuth Client ID is optional under Advanced settings), select Add, then Connect.

On Team and Enterprise, the Owner adds a custom connector at Organization settings > Connectors.

Control it. In a chat, select + > Connectors to turn NetSuite on. On the connector’s page, each user sets Tool permissions: Always allow, Needs approval or Blocked, per tool. Team and Enterprise Owners can also limit actions organization-wide.

A cautious start blocks ns_createRecord and ns_updateRecord, or sets them to Needs approval. This is a second layer: the NetSuite role is the control you enforce.

Connect NetSuite to ChatGPT

Option A: the NetSuite app (Standard Tools). Oracle’s steps: Apps in the sidebar (OpenAI’s help center now says Settings > Plugins), search NetSuite, select the app, Connect, Sign in to NetSuite, select the non-Administrator role, Continue.

OpenAI says availability depends on plan, region, workspace, role and interface; neither vendor publishes a plan list for this app.

Option B: a custom app in developer mode (custom tools, /all). OpenAI’s pages disagree on plans (read September 26, 2026): its developer guide lists Pro, Plus, Business, Enterprise and Education.

Its help center says write actions are rolling out in beta to Business, Enterprise and Edu, Pro gets read/fetch only, and on Business only admins and owners use developer mode.

Help center steps: enable developer mode (Settings > Apps > Advanced Settings), Apps > Create, enter the URL, choose OAuth, Scan Tools, sign in to NetSuite, Create. Oracle adds that ChatGPT with custom tools needs a new integration record for every new connection.

NetSuite MCP in Claude Code

Simplest: reuse the claude.ai connector. Connect NetSuite on claude.ai first. Claude Code logged in with a claude.ai subscription lists your connectors in /mcp, unless ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, apiKeyHelper, Bedrock or another third-party provider is active. A server added in Claude Code with the same URL hides the connector.

Direct connection (Oracle’s procedure is in SuiteAnswers 1045678):

claude mcp add --transport http netsuite https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools

Then run /mcp, or claude mcp login netsuite, and sign in to NetSuite in the browser.

This path does not use Claude’s automatic integration record: Anthropic says Claude Code runs its own OAuth client with a loopback redirect.

NetSuite’s metadata offers no Client ID Metadata Document, so Claude Code falls back to Dynamic Client Registration (DCR). NetSuite’s DCR only returns the client ID of an administrator-made record with Dynamic Client Registration checked and a matching redirect.

So expect to create a record. Set its Client Name for Dynamic Client Registration to Claude Code (the name in Claude Code’s metadata document), or pass its client ID with --client-id and a fixed --callback-port. Oracle’s record page rejects http:// redirects yet describes localhost ones: test in a sandbox.

If the direct flow fails (GitHub issues #11862, #21799), use the claude.ai route. Oracle’s Claude Code plug-ins add skills, not the connection (agent skills guide).

Codex

Oracle’s procedure is SuiteAnswers 1045686. OpenAI’s generic setup, in ~/.codex/config.toml or a trusted project’s .codex/config.toml:

[mcp_servers.netsuite]
url = "https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools"
# Illustrative: hide the two write tools
disabled_tools = ["ns_createRecord", "ns_updateRecord"]

Or run codex mcp add netsuite --url <server URL>, then codex mcp login netsuite. Without a client ID, Codex also falls back to DCR, so it too needs an administrator-made record. With --oauth-client-id <id>, Codex prints the callback URL to register.

NetSuite’s metadata does not advertise RFC 9207 issuer identification, so that callback ends with a server-specific ID, such as http://127.0.0.1/callback/<callback_id>: register exactly what Codex shows.

Codex inserts the port at login; if NetSuite needs an exact port, set mcp_oauth_callback_port and register that port. Tool calls time out after 60 seconds by default (tool_timeout_sec).

Cursor and VS Code

No Oracle procedure was found. Oracle’s FAQ says any client can work if it supports remote MCP, protocol version 2025-06-18, Streamable HTTP, and OAuth 2.0 Authorization Code Grant with PKCE.

Cursor reads .cursor/mcp.json or ~/.cursor/mcp.json and supports OAuth:

{
  "mcpServers": {
    "netsuite": {
      "url": "https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools"
    }
  }
}

A registered client goes in an auth object with CLIENT_ID. Cursor’s desktop redirect is http://localhost:8787/callback. A Reddit user reported in July 2026 that Cursor’s move from a cursor:// redirect to http://localhost broke their NetSuite setup.

VS Code uses .vscode/mcp.json ("servers", then "type": "http" and "url") or the MCP: Add Server command. An oauth object requires clientId.

Copilot Studio

Oracle’s procedure is SuiteAnswers 1046882. Microsoft’s generic path: agent Tools page > Add a tool > New tool > Model Context Protocol, then server name, description, URL, OAuth 2.0, type Manual. Its fields, with Oracle’s NetSuite values:

  • Client ID and Client secret: from your integration record (see the conflict below).
  • Authorization URL: https://<accountID>.app.netsuite.com/app/login/oauth2/authorize.nl
  • Token URL template and Refresh URL: https://<accountID>.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token
  • Scopes (optional): mcp

After Create, copy the callback URL Copilot Studio shows into the record’s Redirect URI.

Watch it: Microsoft Community Learning, MCP server with OAuth 2.0 in Copilot Studio (May 2026) uses Entra ID, not NetSuite, but shows the Manual fields and, at 08:46, the callback URL to paste back.

Microsoft’s form requires a client secret. Oracle lists Public Client (no secret) as a key property of AI Connector records, yet also documents the mcp scope with confidential clients. Public docs do not settle which record Copilot Studio needs: follow SuiteAnswers 1046882 or test in a sandbox.

Tanwa Sripan’s blog (updated March 2026) and Gurus Solutions (July 2026, updated September 2026) report that the built-in OAuth 2.0 now connects; ignore Gurus’s “client credentials record”, which conflicts with Oracle’s setup.

Eureka Solutions, a UK partner, said in July 2026 that customers told it Copilot (the speaker did not say which) did not work with the connector, and that it had stopped suggesting they try (Eureka Solutions, The Responsible AI Playbook for NetSuite). Test before you promise Copilot to users.

Other clients (Postman, Gemini, custom agents)

The same four requirements apply, and a person must sign in: Oracle requires the machine-to-machine grant to be cleared for this scope. Oracle covers Postman in SuiteAnswers 1022684; no Oracle procedure was found for Gemini.

The integration record and OAuth 2.0 tokens

Claude: nothing to create here, and the ChatGPT app usually needs nothing either. Read on for other clients.

How sign-in works: the AI client sends the user to the NetSuite login page to sign in, pick the AI role and approve. The client receives tokens, never the password.

The integration record

An integration record tells NetSuite which OAuth 2.0 client may connect.

  • Claude: installed after the first connection (Setup > Integration > Manage Integrations) and enabled regardless of account settings; State and Concurrency Limit are editable. Claude Code’s direct connection does not use it.
  • ChatGPT: practitioner videos show a record created automatically (Prolecto at 41:50). Oracle notes a new record may be needed per connection, because of dynamic callback URLs.
  • Other clients: a record created automatically (for example during a SuiteApp installation) with the NetSuite AI Connector Service scope starts pending until an administrator enables it, and can then only be disabled. If the scope is missing, recreate it. If none exists, create one.

To create one (Administrators or the Integration Application permission):

  1. Setup > Integration > Manage Integrations > New; enter a Name; State = Enabled.
  2. Authentication subtab: check Authorization Code Grant and Public Client; enter the client’s Redirect URI; check NetSuite AI Connector Service.
  3. Leave cleared: Token-based Authentication boxes, Client Credentials boxes, Client Credentials (Machine to Machine) Grant, and the RESTlets, REST Web Services and SuiteAnalytics Connect scopes.
  4. Optional: Dynamic Client Registration (requires Public Client) lets a client obtain this record’s client ID through a matching redirect URI. With a localhost redirect, Client Name for Dynamic Client Registration must match the client’s client_name.
  5. Save, and copy the client ID now: NetSuite shows the credentials only once.

The consent screen cannot be skipped: Oracle makes the Never Ask consent policy unavailable for this scope. Redirect URIs published by vendors:

Client Redirect URI
Claude (web, desktop, mobile, Cowork) https://claude.ai/api/mcp/auth_callback
Claude Code http://localhost:<port>/callback; the port varies unless fixed with --callback-port
Codex The exact URL codex mcp add ... --oauth-client-id <id> prints; for NetSuite, expect http://127.0.0.1/callback/<callback_id>
Cursor (desktop) http://localhost:8787/callback
ChatGPT https://chatgpt.com/connector/oauth/{callback_id} (the stable https://chatgpt.com/connector_platform_oauth_redirect needs RFC 9207 issuer identification, which NetSuite does not advertise, checked September 26, 2026)
Copilot Studio The callback URL shown after Create

OAuth 2.0, PKCE and token lifetimes

The client requests scope=mcp, which must be used alone and requires PKCE (S256). On the consent screen the user sees the role and can choose another.

  • Access token: 60 minutes.
  • Refresh token (public clients): single-use, valid two days by default. Field Refresh Token Validity (In Hours): default 48, range 1 to 720.
  • Maximum Time For Token Rotation (In Hours): default 168, range 1 to 720; afterwards the user must sign in again.

So users reconnect: Prolecto describes connections lasting about two or seven days depending on use (at 43:13). Oracle notes installed integrations may have other defaults.

Each record’s Execution Log tab, AI Connector Service (MCP) subtab, keeps calls 21 days in production and seven in sandbox. See the governance guide.

Sandbox and multiple accounts

  • A sandbox has its own URL (123456-sb1), so it is a separate connection.
  • OAuth 2.0 authorizations are never copied from production to sandbox. Users authorize in the sandbox, and again after every refresh.
  • A refresh overwrites the sandbox with production’s configuration, so sandbox-only setup (a test role or integration record) is lost. SAML configuration is not copied.
  • Install the SuiteApp in the sandbox itself (an Anthropic engineer’s advice on GitHub, May 2026).
  • An open issue (claude-ai-mcp#737, July 2026) reports Claude failing on a sandbox while production works.

Multiple accounts: each has its own URL, SuiteApp, role and consent. Tim Dietrich’s guide (January 2026) adds a second Claude custom connector named, for example, “NetSuite Sandbox”. Elsewhere, add one named entry per account. Whether Claude’s directory connector holds two accounts is not documented.

With several accounts connected, turn on only the right one (in Claude, + > Connectors) or name it in the prompt, above all before a write. For ChatGPT, Crowe’s Alejandro Alvarez says you “have to tell it which one to use” (AI & MCP with NetSuite Part 2, May 2026).

Test the connection: first prompts

Run these yourself, signed in with the AI role, before handing over. Prompt 5 belongs in a sandbox.

  1. “List the NetSuite tools you can use, by name.” With the four permissions in Step 3, expect the 14 tools (plus up to three MCP Apps ending in _app). Without REST Web Services, the four record tools and ns_getSuiteQLMetadata are missing; without Perform Search, the saved search tools.
  2. “Using the report tools, list the subsidiaries I can access.” Expect only those the role allows (Oracle gives consolidated ones negative IDs).
  3. “List my saved searches, then run [name] and show 10 rows.” Compare with NetSuite.
  4. “Run the income statement from January 1 to June 30, 2026 for [subsidiary], and name the tool you used.” Expect ns_runReport; compare totals with NetSuite’s report for the same dates. Report tools take dates, not accounting periods.
  5. Sandbox only: “Show me the fields, then create a customer named MCP Test with externalId mcp-test-001.” Oracle recommends an external ID on every create. A View-only role should refuse it (Prolecto Resources, a refused create: ChatGPT asks to confirm, then NetSuite returns a permission error).

Then, at Setup > Integration > Manage Integrations, the client’s record should show State Enabled, and its Execution Log your calls. Checking numbers: the finance guide.

Common problems

Symptom Likely cause Fix
“Your role does not support OAuth2 login, please select a different one.” or no role offered Administrator role; Log in using Access Tokens instead of the OAuth 2.0 one; Core Administration Permissions (community report); role just assigned; SAML user, role without SAML Single Sign-on Fix the role (Step 3); log out and back in (Prolecto Resources, no role offered)
Connected, but no tools or “access denied” SuiteApp not installed in this account; missing permissions; SuiteApp folder restricted Check installation (sandbox too), permissions, File Cabinet folder
Connector shows Disconnected right after connecting Oracle’s FAQ: URL truncated (missing /all or the /suiteapp/... part), SuiteApp not installed, role not properly configured. Also: _SB1 instead of -sb1, or service/mcp copied from one Oracle Companion page (the path is services/mcp) Paste a full URL from Step 4; check the SuiteApp and the role
Reports and SuiteQL work, record tools missing or failing REST Web Services permission missing (the feature is not enough) Add it (Full), then refresh or reconnect the connector (Prolecto Resources, record tools appear)
Drops every few days Refresh token (48 hours, single-use), token rotation (168 hours) Reconnect; adjust fields on records you manage (details)

Red flags in video tutorials:

  • “MCP Sample Tools”: retired, yet shown in some videos published after September 2025.
  • Token-based authentication (TBA) keys for a third-party gateway: not Oracle’s connector, and Oracle accepts no new TBA integrations from 2027.1.

More errors, including client-specific ones: the troubleshooting guide.

FAQ

Does the NetSuite AI Connector need extra NetSuite licenses?

Oracle’s FAQ lists no license beyond each user’s login. The service is not a paid feature, MCP Standard Tools is free, and it uses no AI Units, unlike NetSuite’s own AI features. Heavy use draws on shared integration concurrency; SuiteCloud Plus licenses add capacity.

What is the NetSuite MCP server URL?

https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools for the Standard Tools, or .../services/mcp/v1/all for every tool, including custom ones. Take the host from the SuiteTalk entry on the Company URLs subtab of Setup > Company > Company Information.

Can Claude create or change NetSuite records? How do I make it read-only?

Yes: ns_createRecord and ns_updateRecord write, within the role’s permissions; there is no delete tool. For read-only, give the role View-level record permissions (or no REST Web Services, which also hides the read-only record tools), then block the two write tools in the AI client. See the permissions guide.

Where does my NetSuite data go when Claude or ChatGPT reads it?

Tool results go to the AI provider, under its privacy policy. Claude Free, Pro and Max users set whether chats train Anthropic’s models (Team and Enterprise: commercial terms). On personal ChatGPT plans, turn off Improve the model for everyone (Settings > Data controls); OpenAI excludes business data from training by default. More: Governing AI access to NetSuite.

How do I switch it off for one user or for everyone?

One user: revoke their authorization at Setup > Users/Roles > OAuth 2.0 Authorized Applications (this invalidates their tokens), then remove the AI role. One AI client: set its integration record’s State to Blocked. Everything: remove MCP Server Connection from the roles. See the governance guide.

Sources

Oracle NetSuite Help Center (read September 26, 2026):

Oracle NetSuite videos:

AI client vendors:

Third party: