Alaz 360 MCP connector for Claude and ChatGPT

What the connector is

The Alaz 360 MCP connector implements the Model Context Protocol, the open standard Claude, ChatGPT and other assistants use to work with external tools. It gives your assistant a curated set of tools to work on your Alaz 360 account, Alaz's business management system.

The server is an intermediary with no credentials of its own: every tool becomes a request to the Alaz 360 API carrying your user's token, and the API decides, on every call, what you can see and do. The server has no direct access to the database.

What you can do

A few examples of what you can ask your assistant once it's connected:

• “Which of my opportunities have an overdue next step this week?”
• “Summarize the latest quote for Constructora Andina and rewrite the scope section in a more direct tone.”
• “Create a task to call the customer on the ‘2027 Renewal’ opportunity tomorrow and assign it to me.”
• “Which customer requests are still unanswered on the B2B Portal project?”
• “Show me the progress and health status of this month's active projects.”
• “Test how the sales bot would answer a customer asking about opening hours.”
• “Draft an Instagram post in the November schedule, without publishing it.”
• “List receivables more than 30 days overdue.”

Tools for modules your Alaz 360 plan doesn't include don't show up in the assistant. For example, without the social media module you won't see the post tools.

Requirements

• An Alaz 360 account with active access to at least one company. Supplier accounts (read-only) can't connect assistants.
• An assistant that supports remote MCP: Claude (web, desktop or mobile), ChatGPT or another MCP client with Streamable HTTP.
• On Claude Team or Enterprise, the organization owner must have enabled the connector if your organization restricts connectors.
• If your company runs its own Alaz 360 installation, your organization identifier (what comes before .alaz.es in your dashboard's address).

How to connect

How you connect depends on the assistant. In every case you sign in with your own Alaz 360 account: nobody shares credentials.

claude mcp add --transport http alaz https://mcp.alaz.es/mcp \
  --header "Authorization: Bearer $ALAZ_MCP_TOKEN"

{
  "mcpServers": {
    "alaz": {
      "type": "http",
      "url": "https://mcp.alaz.es/mcp",
      "headers": {
        "Authorization": "Bearer ${ALAZ_MCP_TOKEN}"
      }
    }
  }
}

OAuth authentication

Claude and ChatGPT connect with OAuth 2.1. Your password never goes through the assistant: you sign in on the Alaz 360 page and the assistant only receives an access token issued for your user.

1. The assistant discovers the authorization server from the MCP server's public metadata (RFC 9728).
2. It redirects you to the Alaz 360 authorization page, which first asks for your organization when needed.
3. You sign in to Alaz 360 and approve access on the consent screen.
4. Alaz 360 returns a single-use code to the assistant, which exchanges it for an access token and a refresh token.
5. On every call, the assistant sends the token to the MCP server, which forwards it to the Alaz 360 API to resolve your identity and permissions.

Technical details

Flow

Authorization code with mandatory PKCE (S256). Confidential clients registered by Alaz, no dynamic client registration.

Scope

mcp

Protected resource

https://mcp.alaz.es/.well-known/oauth-protected-resource (RFC 9728)

Authorization server

https://api.alaz.es/.well-known/oauth-authorization-server (RFC 8414)

Redirects

Exact match against each client's registered redirect URIs. The response includes the iss parameter (RFC 9207).

Token lifetime

Authorization code: 60 seconds, single use. Access token: 1 hour. Refresh token: 14 days, single use (rotated on every refresh).

Tokens

Opaque, validated by the Alaz 360 API on every call. The personal MCP token lasts 90 days.

Permissions: what the AI can read and change

The connector doesn't widen your permissions or open a new path to your data: the assistant acts on your behalf, under the same rules the Alaz 360 dashboard applies to you.

What it can change

Of the 163 tools, 24 create records without touching existing ones and 62 change or delete data inside Alaz 360. They include: creating and updating opportunities, tasks, projects, deliverables, contacts, products, orders and draft quotes and invoices; editing proposals and contract clauses; configuring bots; preparing posts; and recording collections and payments that already happened.

Features that use Alaz 360's AI

regenerate_quote_section, regenerate_contract_clause and test_bot_message ask Alaz 360's AI for the text, which processes it with the same model provider that feature uses in the dashboard.

Tool catalog

These are all the tools the server exposes, grouped by area. Each tool's level comes from its MCP annotations, which Claude and ChatGPT use to decide when to ask for confirmation.

Read

Lookup only. readOnlyHint.

Creates

Creates a record or runs a test without overwriting or deleting.

Changes or deletes

Overwrites or deletes data inside Alaz 360. destructiveHint.

External effect

Its effect leaves Alaz 360: email, social media or WhatsApp. openWorldHint.

Confirmations and control

Claude and ChatGPT use each tool's annotations to decide when to ask you for permission. Read-only tools can run without interruption; tools that change, delete or have an external effect ask for confirmation according to your assistant's settings.

• Review what the assistant is about to send before confirming an action, especially amounts, recipients and dates.
• In Claude you can turn off specific tools or require approval on every use from the connector menu.
• For lookup-only use, turn off non-read tools in your assistant or use a user with a read-only role in Alaz 360.

Security

The connector is designed not to be an extra entry point to your data.

Privacy and data handling

This section summarizes how the connector handles data. It complements the Privacy Policy and the Alaz 360 Terms of Service, which remain the reference documents.

Controller: ALAZ SAC (RUC 20611866756), Av. Costanera 1200, San Miguel, Lima, Peru. For privacy questions or to exercise your rights, write to [email protected].

Related policies

• Privacy Policy
• Alaz 360 Terms
• Terms & Conditions
• Cookie Policy

Revoking access

You can disconnect the assistant at any time. For an immediate, complete cut-off, also revoke the connection in Alaz 360.

From the assistant

In Claude, open Settings → Connectors, choose Alaz 360 and disconnect it. In ChatGPT, disconnect the Alaz 360 app from the apps settings. This removes the connection in the assistant; revoking it in Alaz 360 also guarantees the tokens stop working.

Personal MCP tokens

Under My account → MCP tokens you can see each token with its creation date, expiry and last use, and revoke it. A revoked token stops working on the next call.

For company admins

If you remove someone from the company or change their role in Alaz 360, the API applies the change on the assistant's next call. The identity cached by the MCP server expires within 60 seconds at most and never grants permissions on its own.

Guide for IT admins

What an IT or security team usually asks for before approving the integration:

Domains

mcp.alaz.es (MCP server), api.alaz.es (API and authorization server) and admin.alaz.es (sign-in and consent).

Access model

Delegated per user with OAuth. No shared accounts or service credentials. Each person authorizes their own access and can revoke it.

Least privilege

Assign roles in Alaz 360 that fit each person. The assistant never exceeds those permissions.

Traceability

Changes are recorded under the user's name. Connected apps shows each connection's last-used date.

Infrastructure

Google Cloud (Firebase Hosting and Cloud Run). HTTPS traffic end to end.

Security contact

Report vulnerabilities or incidents to [email protected] with the subject “Security”.

Troubleshooting

Frequently asked questions

Support