Skip to main content
This is the official NetSuite MCP server, served by Oracle’s MCP Standard Tools SuiteApp (the NetSuite AI Connector Service). It is a separate connector from NetSuite, which exposes Aperium’s own typed REST read/write surface and entity-query datasets. The two coexist and share nothing except NetSuite’s OAuth hosts. Enable this one when you want agents to use the tools NetSuite itself publishes through its managed MCP endpoint; enable the typed NetSuite connector when you want Aperium’s curated REST tools. You can run both.
The NetSuite MCP connector is a first-party managed remote MCP integration. Instead of shipping a fixed list of tools, Aperium points at NetSuite’s own MCP endpoint and materializes a managed MCP server for your tenant when the admin saves the OAuth app credential. The tools that appear are the ones NetSuite publishes for the connecting user, and each user only sees tools their NetSuite role permits.

​
What you’ll need

  • The MCP Standard Tools SuiteApp installed in your NetSuite account.
  • An integration record configured with the NetSuite AI Connector Service scope. This yields the OAuth client ID the admin enters.
  • Your NetSuite account ID (Setup > Company > Company Information). Sandbox accounts carry a -sb suffix, for example 1234567-sb1.
  • A NetSuite role for each user that is not Administrator, carrying only the record permissions those users should reach through agents.

​
How auth works

NetSuite MCP uses OAuth 2.0 authorization code with PKCE, with the scope fixed to exactly mcp — NetSuite’s AI Connector Service rejects any other scope on its integration record. Connections are layered: the admin registers the tenant’s OAuth app once (client ID + account ID), then each user signs in to NetSuite individually and Aperium calls NetSuite as that user.

​
Setup

1

Install the SuiteApp and create the integration record

In NetSuite, install the MCP Standard Tools SuiteApp and create an integration record scoped to the NetSuite AI Connector Service. Note the client ID it produces.
2

Open the NetSuite MCP form in Aperium

Open the admin onboarding flow (first sign-in) or the Admin Console’s MCP Servers tab (any time after), and open the Connect NetSuite MCP form.
3

Enter the account ID and OAuth app credentials

Fill in your NetSuite account (for example 1234567 or 1234567-sb1) and the integration record’s OAuth client credentials. Aperium shows the redirect URI to register back in NetSuite. Saving the credential provisions a managed MCP server for your tenant.
4

Each user connects with their NetSuite role

Once the tenant app is configured, the integration appears on every user’s Integrations page. Each user clicks to connect, signs in to NetSuite with their own (non-Administrator) role, and the OAuth PKCE flow completes. The tools that user can call are then scoped to their NetSuite permissions.

​
What agents can do

The available tools are discovered from the managed MCP server at connection time and follow each user’s NetSuite role, so the exact set varies by account and by user. NetSuite records, transactions, saved searches, and reports are the typical surface.

​
Raw SuiteQL is withheld by design

This connector deliberately withholds the raw SuiteQL tools (ns_runCustomSuiteQL and its metadata helper) that the official server otherwise exposes. They never appear as agent-facing tools or in the tool-permission grids, because raw SuiteQL is unguarded, agent-authored SQL with no read-only guard. Re-exposing them would be a reviewed manifest change, not a runtime toggle.
In their place, Aperium provides a validated records-query surface: agents describe the records they want in a structured form, and Aperium compiles it to bounded, whitelisted SuiteQL for execution. This keeps the freeform query path available without handing agents an unrestricted SQL tool — the same intentional gating applied when the typed NetSuite connector retired its own raw run_suiteql tool.

​
Notes

  • Coexistence. Enabling NetSuite MCP does not affect the typed NetSuite connector, and vice versa. They authenticate through the same NetSuite OAuth hosts but are independent integrations with independent tool surfaces.
  • Role scoping is the access control. Because tools follow each user’s NetSuite role, keep MCP roles narrow. An Administrator role is rejected for this connection.