Epicor MCP

Production FastMCP server for Epicor Kinetic. Read-only. There are no write tools and the HTTP client rejects any method other than GET.

Auth follows the same split used by Azure MCP and Atlassian Rovo:

1. Inbound — the MCP client authenticates to this server (HTTP only).

2. Outbound — this server authenticates to Kinetic (X-API-Key plus Basic or Bearer).

HTTP is fail-closed without MCP_JWKS_URI or MCP_JWT_SECRET.

Author: Clinton Follette.

Tools

$select is always applied. The Kinetic Company id is configuration, not a tool argument.

Related MCP server: TrakSYS MCP Server

Install (local STDIO)

{
  "mcpServers": {
    "epicor": {
      "command": "mcp-epicor",
      "env": {
        "EPICOR_BASE_URL": "https://your-server/kinetic",
        "EPICOR_COMPANY": "YOURCO",
        "EPICOR_API_KEY": "<key>",
        "EPICOR_USERNAME": "<user>",
        "EPICOR_PASSWORD": "<password>"
      }
    }
  }
}

pip install .
mcp-epicor

Remote HTTP

export MCP_TRANSPORT=http
export MCP_HOST=127.0.0.1
export MCP_PORT=8002
export MCP_JWKS_URI=https://login.example.com/.well-known/jwks.json
export MCP_JWT_ISSUER=https://login.example.com
export MCP_JWT_AUDIENCE=mcp-epicor
mcp-epicor

Endpoint: http://127.0.0.1:8002/mcp. Health: GET /health.

Outbound Kinetic configuration

Security

• No POST/PATCH/DELETE helpers exist on the client.

• HTTP without inbound JWT configuration refuses to boot.

• Vendor 401s do not echo credentials.

See SECURITY.md.

License

MIT. Copyright (c) 2026 Clinton Follette.