Northspyre

MCP Docs

Northspyre MCP Server

Securely connect AI assistants to your Northspyre data. Ask questions about projects, budgets and invoices in plain language — with the same permissions you already have.

https://mcp.northspyre.com/mcp

Overview

The Model Context Protocol (MCP) is an open standard that lets AI assistants call tools in other applications. The Northspyre MCP server exposes 128 tools for working with Northspyre data from Claude, ChatGPT, Cursor and other compatible clients.

100+
tools
OAuth 2.1
sign-in
Per-user
permissions

Connection details

Server URL
https://mcp.northspyre.com/mcp
Transport
Streamable HTTP (HTTPS only)
Authentication
OAuth 2.1 with PKCE
Access scope
The signed-in Northspyre user's permissions

Client setup

  1. Open Settings → Connectors in Claude (web or desktop).
  2. Click Add custom connector, name it "Northspyre", and paste the server URL.
  3. Click Connect and sign in to Northspyre when prompted.
  4. Enable the connector in a chat from the tools menu.

Authentication

The server uses OAuth 2.1. No API keys or passwords are ever shared with the AI client.

  1. The AI client discovers Northspyre's authorization server from the MCP server's metadata.
  2. You're redirected to the Northspyre login page and sign in as usual, including your organization's SSO if enabled.
  3. You review and approve the client's access request.
  4. The client receives a short-lived access token scoped to your account, and refreshes it as needed.

Available tools

128 tools in total: 72 read tools and 56 write tools. Your AI client shows the full list after you connect.

Read tools (72)

ProjectsBudgetsCommitmentsInvoices & paymentsDrawsVendorsCompliance (lien waivers, COIs)BidsApprovalsInbox, email & meetingsScheduleCost codes (ERP & accounting)External data (weather, tariffs)Session

Write tools (56)

CreateUpdateDeleteDraw approvalsBid invitationsSchedule batch updatesProject metadataOrganization selection

Write tools only work where the signed-in user already has edit rights in Northspyre. Most AI clients ask you to confirm before running them.

Security for IT admins

  • Least privilege. Tools act as the signed-in user and respect existing Northspyre roles and project permissions.
  • Standards-based auth. OAuth 2.1 with PKCE. Tokens are short-lived and can be revoked.
  • SOC 2 Type II. Northspyre is SOC 2 Type II certified and hosted on AWS.
  • Encryption. Data is encrypted in transit (HTTPS / TLS) and at rest with industry-standard encryption.
  • User consent. Users explicitly approve each AI client before it can access data.
  • Revocation. Disconnect from the client, or remove the user's Northspyre access to cut off the connection.

Full details on certifications, data protection and privacy are on the Northspyre Security & Compliance page. Data returned to an AI client is processed under that client provider's terms. Review your AI vendor's data-retention settings as part of approval.

FAQ

Does the AI see everything in our Northspyre account?

No. Every request runs as the signed-in user, so the assistant can only see and do what that person already can in Northspyre.

Can access be revoked?

Yes. Users can disconnect from their AI client at any time, and admins can revoke a user's access by removing or changing their Northspyre permissions.

Do we need to share passwords or API keys?

No. Users sign in through the standard Northspyre login page. The AI client only receives a short-lived access token.

Which network endpoint should we allow?

Allow outbound HTTPS to mcp.northspyre.com on port 443.