Skip to main content
Glama
mikko-bautista-113580

Creatio Case Toolkit MCP Server

Creatio Case Toolkit

A read-only toolkit for working with Creatio Support cases:

  • an MCP server that exposes Creatio's OData API to AI clients (Claude Code, Claude Desktop, โ€ฆ), and

  • a local web app that lets non-technical users look up cases by clicking menus โ€” with descriptions, conversation timelines, inline attachments, and optional AI analysis powered by the Claude CLI.

Everything is read-only by construction: the HTTP layer only ever issues GET, there are no create/update/delete paths, and an entity allowlist + row cap keep the blast radius small. Safe to point at production.

Status: early/active. Read-only today; a gated write-back capability (draft & post case updates with human approval) is on the roadmap.


Features

  • ๐Ÿ”’ Read-only by design โ€” GET-only client, no write tools, entity allowlist, $top clamp.

  • ๐Ÿงฐ MCP server โ€” creatio_query_records, creatio_get_record, creatio_list_allowed_entities.

  • ๐Ÿ–ฅ๏ธ Local web app โ€” look up cases by owner, case number, account, or "all recent"; filter by status; choose detail depth.

  • ๐Ÿงต Rich case detail โ€” HTML-stripped descriptions, merged feed + email timeline, and inline screenshots/attachments proxied from Creatio's FileService.

  • โœจ AI analysis (optional) โ€” Summarize & prioritize, Common themes, Next actions, or free-text Q&A over the loaded cases; streamed live via the local Claude CLI (uses your existing Claude login โ€” no API key).

  • โš™๏ธ In-app settings โ€” paste/refresh SSO cookies, base URL, allowlist, row cap; no VS Code required.

  • ๐Ÿ“ก Live progress โ€” the search streams per-case progress with a percentage bar.

Related MCP server: mcp-sqlserver-readonly

Repository layout

src/
  creatioClient.ts   Shared read-only OData client (auth, cookies, GET, file download)
  caseLookup.ts      Case-lookup query recipes (search, description, timeline, attachments)
  analyze.ts         Claude CLI runner for AI analysis (streaming, isolated, no tools/MCP)
  server.ts          Local web app: static hosting + JSON/SSE API
  index.ts           MCP server (thin surface over creatioClient)
  test-auth.ts       Standalone credential check
public/              Web app UI (vanilla HTML/CSS/JS, zero runtime deps)
start-app.bat        One-click launcher for the web app (Windows)
.env.example         Copy to .env and fill in

Quick start

Prerequisites: Node.js 18+ (developed on Node 24).

git clone <your-repo-url> creatio-case-toolkit
cd creatio-case-toolkit
npm install
npm run build
cp .env.example .env      # then edit .env (see Configuration)
npm run test-auth         # confirm credentials work (โœ” Success)

Run the web app:

npm run app               # builds, starts the server, opens http://127.0.0.1:3000

On Windows you can just double-click start-app.bat.

Register the MCP server in Claude Code (see MCP server for .mcp.json form):

claude mcp add creatio-readonly \
  --env CREATIO_BASE_URL=https://<your-tenant>.creatio.com \
  --env CREATIO_ALLOWED_ENTITIES=Case,Activity,Contact,Account,SocialMessage \
  -- node ./dist/index.js

Configuration

All settings live in .env (and, for the MCP server, in its client registration). Never commit .env โ€” it holds live credentials/cookies (it's git-ignored by default).

Variable

Purpose

CREATIO_BASE_URL

Your Creatio URL, e.g. https://<your-tenant>.creatio.com

CREATIO_LOGIN / CREATIO_PASSWORD

Forms-auth service account (Mode 1)

CREATIO_ASPXAUTH / CREATIO_BPMCSRF / CREATIO_BPMLOADER

SSO session cookies (Mode 2)

CREATIO_ALLOWED_ENTITIES

Comma-separated entity allowlist (e.g. Case,Activity,Contact,Account,SocialMessage)

CREATIO_MAX_TOP

Max rows per query (default 50)

CREATIO_APP_PORT

Web app port (default 3000)

CREATIO_APP_NO_OPEN

Set 1 to stop the app auto-opening the browser

CREATIO_APP_MODEL

Model for AI analysis (e.g. sonnet, haiku); default = your CLI default

Authentication

The client auto-selects a mode based on which vars are set.

  • Mode 1 โ€” Forms auth (recommended): a local, least-privilege, read-only Creatio service account (CREATIO_LOGIN + CREATIO_PASSWORD). Re-authenticates automatically on expiry.

  • Mode 2 โ€” Cookie auth (SSO tenants): paste a browser session's cookies (.ASPXAUTH, BPMCSRF, BPMLOADER) from DevTools โ†’ Application โ†’ Cookies. Cookies expire in hours; refresh them in .env or the app's Settings tab and the next query picks them up โ€” no restart needed.

Verify either mode with npm run test-auth.


Web app

  • Lookup tab โ€” choose who (assignee / case number / account / all recent), which statuses, and how much detail (summary, full description, timeline, latest update, extra fields), then Search. Results stream in with a progress bar.

  • Attachments โ€” screenshots embedded in descriptions and feed posts render inline (click to enlarge); email attachments appear as thumbnails. Images are streamed through a read-only /api/file proxy restricted to file entities + GUID ids.

  • Settings tab โ€” base URL, cookies, allowlist, row cap, plus Test connection.

The server binds to 127.0.0.1 only and the only file it ever writes is your local .env.

AI analysis

With the Claude CLI installed and logged in, the results view shows an "Analyze with AI" bar โ€” Summarize & prioritize, Common themes, Next actions, or a free-text question, streamed live and rendered as Markdown (copy / download as .md). Tick row checkboxes to analyze a subset; each row also has a "โœจ analyze this one" button.

  • Enable: npm i -g @anthropic-ai/claude-code, then run claude once to sign in. Uses your Claude subscription โ€” no API key.

  • Runs claude -p locally, isolated (no tools, no MCP, empty temp cwd); only the selected cases' text is sent โ€” never your cookies. Set CREATIO_APP_MODEL=sonnet (or haiku) for cheaper/faster runs.


MCP server

Tool

Description

creatio_list_allowed_entities

Show base URL, allowlist, and row cap

creatio_query_records

OData query ($filter, $select, $orderby, $top, $expand)

creatio_get_record

Fetch one record by GUID

.mcp.json form:

{
  "mcpServers": {
    "creatio-readonly": {
      "command": "node",
      "args": ["./dist/index.js"],
      "env": {
        "CREATIO_BASE_URL": "https://<your-tenant>.creatio.com",
        "CREATIO_ALLOWED_ENTITIES": "Case,Activity,Contact,Account,SocialMessage",
        "CREATIO_MAX_TOP": "50"
      }
    }
  }
}

Foreign keys like OwnerId/AccountId/StatusId are not filterable โ€” filter through navigation paths (Owner/Id, Account/Id, Status/Name). See CASE-QUERY-REFERENCE.md for the full query recipes and gotchas.


Security & data handling

  • Read-only: the client issues HTTP GET only; there is no write path to Creatio anywhere in the codebase.

  • Local & single-user: the web app binds to 127.0.0.1, with no app-level auth by design.

  • Secrets stay local: cookies/credentials live in .env (git-ignored) and are masked in the UI; AI analysis receives only case text, never cookies.

  • Bounded reach: entity allowlist + $top clamp; the file proxy is limited to a fixed set of file entities and GUID ids.


Roadmap

  • โœ๏ธ Write-back (Stage 3): draft case replies / status updates with AI, then post them to Creatio on explicit human approval, and verify the write succeeded. This is the planned next step and will be gated, audited, and opt-in โ€” the read-only default stays.

  • OAuth 2.0 client-credentials auth for unattended SSO use.

  • Pagination past the 50-row cap in the UI; attachment-count badges.

  • Optional ActivityFile inline email images.

Agentic maturity: today the toolkit is Stage 2 โ€” Multi-Step (multi-step, multi-tool, read-only "generate but don't run"); the in-app Analyze feature is Stage 1 โ€” Guided Task. Write-back is what moves it into Stage 3 โ€” Autonomous Workflow.


Scripts

Script

Does

npm run build

Compile TypeScript to dist/

npm run app

Build + start the web app

npm start

Start the MCP server (stdio)

npm run test-auth

Verify credentials without starting anything

License

Add a license (e.g. MIT) before publishing.

Available Tools

3 tools
creatio_get_recordA

Fetch a single Creatio record by its GUID Id (read-only GET).

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesRecord GUID, e.g. 'f3ed4f55-894b-42bc-b5a1-f10b9d0bc03f'.
entityYesOData entity set name, e.g. 'Case'.
expandNoOData $expand for lookups.
selectNoColumns to return.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It explicitly discloses the read-only, non-mutating nature via 'read-only GET', which is a key behavioral trait. It does not detail error handling or edge cases, but for a simple fetch operation, the transparency is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no redundancy. Every phrase ('Fetch', 'single', 'by GUID Id', 'read-only GET') contributes to clarity and utility.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-record fetch with no output schema, the description covers the essential usage and safety aspects. It does not explain return format or error behavior, but the operation is simple enough that the description is largely complete, especially given the schema already documents all parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter having a meaningful description (e.g., id includes an example, expand and select are briefly defined). The tool description adds no additional parameter semantics; the baseline of 3 applies because the schema already provides full coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (Fetch), the resource (Creatio record), and the exact identifier (GUID Id). The 'read-only GET' suffix further clarifies the operation and differentiates it from sibling tools like cretio_list_allowed_entities and creatio_query_records, which handle listing and querying, respectively.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The wording 'single record by its GUID Id' gives clear context for when to use this tool โ€“ when you have a specific record ID. It does not explicitly name alternative tools or exclusions, but the context implies it is not for listing or multi-record queries, which are covered by siblings. This is a clear usage hint without explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

creatio_list_allowed_entitiesA

List the Creatio OData entity sets this server is permitted to read. If the allowlist is empty, all entities are readable.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses an important behavioral nuance: if the allowlist is empty, all entities are readable. This adds context beyond a simple listing, though it does not describe the exact return format or pagination, which are minor for a metadata list.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary purpose, and includes a one-sentence edge case. Every word adds value without redundancy. This is exemplary conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given low complexity, zero parameters, and no output schema, the description covers the core functionality and a key edge case. It is sufficient for an agent to understand what the tool does, though lacking an explicit mention of return structure is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the input schema provides complete coverage. The baseline for 0 params is 4, and the description does not need to compensate. It accurately reflects that no parameters are required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'List' and identifies the resource 'Creatio OData entity sets' along with the context 'this server is permitted to read.' It clearly distinguishes from siblings like creatio_query_records and creatio_get_record, which focus on records rather than metadata discovery.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage as a discovery step before querying or getting records, but it does not explicitly state when to use this tool versus alternatives or provide exclusions. The sibling names suggest a workflow, but the description itself lacks direct guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

creatio_query_recordsA

Query records from a Creatio entity via OData (read-only GET). Use OData syntax for filter/orderby, e.g. filter: "Number eq 'SR00042038'".

ParametersJSON Schema
NameRequiredDescriptionDefault
topNoMax rows (clamped to 50).
entityYesOData entity set name, e.g. 'Case' or 'Contact'.
expandNoOData $expand for lookups, e.g. 'Owner'.
filterNoOData $filter expression.
selectNoColumns to return, e.g. ['Id','Number','Subject'].
orderbyNoOData $orderby, e.g. 'CreatedOn desc'.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description explicitly discloses 'read-only GET', which is key behavioral information indicating no mutation. It does not mention that 'top' is clamped to 50 or other potential behaviors like pagination, but the read-only disclosure is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no fluff: the first states purpose, the second gives usage guidance with an example. Properly front-loaded and concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only query tool with no output schema, the description covers purpose, safety, and includes a usage example. It does not describe the return format, but that is implied by 'records' and the OData context, and the schema fills in parameter details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds a concrete OData filter example ('Number eq \'SR00042038\'') and reinforces that filter/orderby use OData syntax, which helps the agent construct valid parameter values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries records from a Creatio entity via OData (read-only GET), specifying the verb, resource, and method. It also distinguishes from siblings: creatio_get_record for a single record and creatio_list_allowed_entities for listing entities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides usage instruction for OData filter/orderby with an example, but does not explicitly state when to use this tool versus alternatives like creatio_get_record or creatio_list_allowed_entities. The context is implied rather than explicit about exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 3 tool updatesv0.1.0
    • First observedcreatio_get_record
    • First observedcreatio_list_allowed_entities
    • First observedcreatio_query_records

TDQS

A4.4/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: listing allowed entities, querying records, and fetching a single record. There is no overlap or ambiguity between them.

Naming Consistency5/5

All tools follow the same verb_noun pattern with the consistent 'creatio_' prefix: list_allowed_entities, query_records, get_record. The naming is uniform and predictable.

Tool Count5/5

With 3 tools, the set is within the typical well-scoped range. Each tool serves a necessary role in the read-only OData use case, with no redundant or missing infrastructure.

Completeness5/5

For a read-only OData server, the tool surface is complete: it covers entity discovery, record querying, and single-record retrieval. No obvious gaps exist for the stated purpose.

Maintenance

ActivitySlowing
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/mikko-bautista-113580/CreatioCaseLookup'

If you have feedback or need assistance with the MCP directory API, please join our Discord server