Onelo MCP connector

Connect an AI assistant to Onelo to inspect and configure one application through a remote Model Context Protocol (MCP) server. You choose the application and whether the connection may make changes.

Before connecting

Sign in to Onelo and open Dashboard → Connected agents → Agents. Copy the Server address shown under Connect an agent. Use that address in your client; no Onelo API key needs to be copied.

The server uses OAuth: your client opens an Onelo sign-in and authorization page in your browser. Check the requesting client, return address and application before allowing access. You can select one existing application or, when your plan and requested permissions allow it, let the connection create one new application. That permission is used once and the connection then covers the application it created.

Connect in Claude

In Claude, open Customize → Connectors, then + Add → Add custom connector. In a team workspace, an owner first adds the remote connector through Organization settings → Connectors.
Name the connector Onelo and paste the Server address from the Onelo dashboard. Review the detected authentication settings and choose sign-in authentication. Use Register automatically for the OAuth client; Onelo supports automatic client registration.
Finish adding the connector and click Connect if prompted. Sign in to Onelo, choose the application and permissions, then click Allow access.
Enable Onelo for your Claude conversation from the connectors menu and ask it to inspect your application.

Client menus and workspace permissions can change. See Claude's current remote connector instructions if the controls differ.

Connect in ChatGPT

Use ChatGPT on the web. Open Plugins, select the plus button, then Add custom MCP server. Your account and workspace must allow custom MCP connections.
Name it Onelo, paste the dashboard Server address under Connection and select OAuth authentication. Use automatic client registration (DCR) when the client offers a registration choice.
Review the client's connection prompt and create the plugin. Complete the Onelo browser authorization: sign in, select one application and choose its permissions.
Install the resulting plugin in your personal plugins or workspace. In a conversation, type @ and select Onelo, then ask it to inspect your application.

If your workspace uses Apps and developer mode, ask its administrator to enable custom MCP apps, then create an app with the same server address and OAuth authentication. Complete authorization when scanning tools. See OpenAI's current custom MCP connection guide for available controls.

The five tools

These are the server's final tool names. A client may display a friendly title beside each name. Ask your assistant to call onelo_whoami first.

Tool	What it does
`onelo_whoami`	Shows the connected account, single application, permissions and next setup step. Summary is the default; detail="full" includes identifiers and the operations that need approval.
`onelo_list_modules`	Lists Onelo modules, their purpose and plan availability, including modules outside your current plan.
`onelo_describe_module`	Explains a module’s operations, required arguments, approvals and manual steps. Select an operation for its full argument schema.
`onelo_read`	Runs a read operation on the connected application, including configuration, status and documentation searches. It makes no changes and refuses write operations.
`onelo_write`	Runs a write operation to create, update or delete state on the connected application. Some operations wait for approval in your Onelo dashboard. It refuses read operations.

Read and write calls take a module, operation and its arguments. The assistant should obtain these from onelo_describe_module. A module appearing in the catalog does not mean your plan includes it or that the server can run every operation; refusals explain the next step.

What you approve in Onelo

Connection authorization chooses one application and whether changes are allowed. It is separate from approving an individual action. Some write operations always need your dashboard approval; you can add more through Connected agents → Rules.

Two of those defaults apply in every workspace and cannot be switched off. Every price change on an existing product waits for your approval, whether or not anybody has bought it yet: a change to the price, the annual price, the currency or the one-time/subscription type. Sending the price the product already has changes nothing and goes straight through, as does a change to its name, description or trial. Every change to the subject or body of an e-mail Onelo sends to your users also waits; the approval shows which e-mail it is and its current and new subject and body. Both reach people who never see the conversation with the assistant, so a person sees them first.

When a call needs approval, Onelo returns a link to Connected agents → Approvals. Nothing runs while the request is pending. Review the client, application, proposed change, its parameters and what happens after approval. Approving runs that action from the dashboard; the assistant can then collect the result. Rejecting or letting the request expire does not run it.

Claude or ChatGPT may also ask you to confirm a tool call. A confirmation in the AI client does not replace an Onelo dashboard approval. Connected agents → Activity shows read and write attempts, including refusals.

Read-only connections and disconnecting

On the Onelo authorization page, untick Change its settings to grant read-only access to an existing application. This connection exposes the four lookup and read tools; onelo_write is omitted, and write calls are refused by the server.

Read-only access can still return application data, subject to personal-data masking. It does not mean anonymous access. To change the connection's read/write permission, disconnect it and authorize again. Disconnect an agent from Connected agents → Agents to revoke its access; you can also remove the connector in your AI client.

Personal-data masking

Personal data is masked by default for each connection. The assistant can work with counts, configuration and masked records without seeing people's details. Masked fields may show ••• or a per-connection identifier; these are not the original values.

In Connected agents → Agents, open the connection's personal-data controls to reveal selected categories. Each connection has its own choices:

Category	What it controls
Who your users are	User names, email addresses and identity fields.
What people bought	Buyer-linked purchase details such as tax numbers; amounts, currencies and payment outcomes remain useful while masked.
Where they connected from	Technical identifiers such as IP addresses and stored IP hashes.
What people wrote in feedback	Feedback text is withheld by default because arbitrary text cannot be reliably masked. Revealing it also enables a hold on writes after the connection reads feedback, unless you turn that hold off separately.

Revealed data is returned to your connected AI client and can become part of its conversation. Changing masking settings or disconnecting later does not remove information already returned to that client. Review the client's data settings before revealing a category.

Reauthorizing a connection resets its personal-data choices to masked. See Onelo's privacy policy for the policy covering the service.