> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aperium.apps.hillspire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NetSuite MCP

> Connect Aperium to the official NetSuite MCP server (NetSuite AI Connector Service) with per-user OAuth and role-scoped tools.

<Note>
  This is the **official NetSuite MCP server**, served by Oracle's MCP Standard Tools SuiteApp (the NetSuite AI Connector Service). It is a separate connector from [NetSuite](/admins/integrations/supported/netsuite), which exposes Aperium's own typed REST read/write surface and entity-query datasets. The two coexist and share nothing except NetSuite's OAuth hosts. Enable this one when you want agents to use the tools NetSuite itself publishes through its managed MCP endpoint; enable the typed NetSuite connector when you want Aperium's curated REST tools. You can run both.
</Note>

The NetSuite MCP connector is a **first-party managed remote MCP** integration. Instead of shipping a fixed list of tools, Aperium points at NetSuite's own MCP endpoint and materializes a managed MCP server for your tenant when the admin saves the OAuth app credential. The tools that appear are the ones NetSuite publishes for the connecting user, and each user only sees tools their **NetSuite role** permits.

## What you'll need

* The **MCP Standard Tools SuiteApp** installed in your NetSuite account.
* An **integration record** configured with the **NetSuite AI Connector Service** scope. This yields the OAuth client ID the admin enters.
* Your **NetSuite account ID** (Setup > Company > Company Information). Sandbox accounts carry a `-sb` suffix, for example `1234567-sb1`.
* A NetSuite role for each user that is **not** Administrator, carrying only the record permissions those users should reach through agents.

## How auth works

NetSuite MCP uses **OAuth 2.0 authorization code with PKCE**, with the scope fixed to exactly `mcp` — NetSuite's AI Connector Service rejects any other scope on its integration record. Connections are **layered**: the admin registers the tenant's OAuth app once (client ID + account ID), then each user signs in to NetSuite individually and Aperium calls NetSuite as that user.

## Setup

<Steps>
  <Step title="Install the SuiteApp and create the integration record">
    In NetSuite, install the **MCP Standard Tools SuiteApp** and create an integration record scoped to the **NetSuite AI Connector Service**. Note the client ID it produces.
  </Step>

  <Step title="Open the NetSuite MCP form in Aperium">
    Open the **admin onboarding flow** (first sign-in) or the **Admin Console's MCP Servers tab** (any time after), and open the **Connect NetSuite MCP** form.
  </Step>

  <Step title="Enter the account ID and OAuth app credentials">
    Fill in your **NetSuite account** (for example `1234567` or `1234567-sb1`) and the integration record's OAuth client credentials. Aperium shows the redirect URI to register back in NetSuite. Saving the credential provisions a managed MCP server for your tenant.
  </Step>

  <Step title="Each user connects with their NetSuite role">
    Once the tenant app is configured, the integration appears on every user's Integrations page. Each user clicks to connect, signs in to NetSuite with their own (non-Administrator) role, and the OAuth PKCE flow completes. The tools that user can call are then scoped to their NetSuite permissions.
  </Step>
</Steps>

## What agents can do

The available tools are discovered from the managed MCP server at connection time and follow each user's NetSuite role, so the exact set varies by account and by user. NetSuite records, transactions, saved searches, and reports are the typical surface.

## Raw SuiteQL is withheld by design

<Warning>
  This connector deliberately **withholds the raw SuiteQL tools** (`ns_runCustomSuiteQL` and its metadata helper) that the official server otherwise exposes. They never appear as agent-facing tools or in the tool-permission grids, because raw SuiteQL is unguarded, agent-authored SQL with no read-only guard. Re-exposing them would be a reviewed manifest change, not a runtime toggle.
</Warning>

In their place, Aperium provides a **validated records-query surface**: agents describe the records they want in a structured form, and Aperium compiles it to bounded, whitelisted SuiteQL for execution. This keeps the freeform query path available without handing agents an unrestricted SQL tool — the same intentional gating applied when the typed NetSuite connector retired its own raw `run_suiteql` tool.

## Notes

* **Coexistence.** Enabling NetSuite MCP does not affect the typed [NetSuite](/admins/integrations/supported/netsuite) connector, and vice versa. They authenticate through the same NetSuite OAuth hosts but are independent integrations with independent tool surfaces.
* **Role scoping is the access control.** Because tools follow each user's NetSuite role, keep MCP roles narrow. An Administrator role is rejected for this connection.