Autovella has a built-in MCP (Model Context Protocol) connection that lets Claude, and other MCP-compatible assistants, work with your Autovella data. Create a personal access token in the MCP card on your Profile page and choose Read-only or Read & write, then connect from Claude Code with one command. If you use claude.ai or ChatGPT web connectors, there is no token to copy, you add a custom connector and approve access when you sign in. Either way, the assistant can only do what you can do in Autovella.
In this guide
How Claude access works, and what it can and cannot doHow to create a personal access tokenHow to connect Claude Code and other MCP clientsHow to connect claude.ai or ChatGPT with OAuth (no token to copy)How to review, revoke and secure your accessFrequently asked questions
How Claude access works, and what it can and cannot do
The connection acts as you. Every request Claude makes is made with your identity, so your role, your permissions, the records you can see and your organization limits all apply exactly as they do in the web app. A token never grants extra rights. An Admin's token can do admin things, while a Contractor's token gets a clean permission-denied message for the same action.
The MCP card is available to every internal role. It is hidden for the Customer role.
Claude can use a fixed set of tools. At the time of writing they cover these areas:
- Projects and tasks: list, read, create, update and delete projects, tasks, subtasks and sections, change task status, move tasks, read project and task history, manage project members, and read Gantt data.
- Sprints: list, create, update and delete sprints, add tasks to a sprint, complete a sprint, and read burndown and velocity.
- Time and people: timesheets (create, submit, approve, reject), attendance check-in and check-out, time-off requests and approvals, holidays, teams and users.
- Finance: expenses, invoices (create, generate, send, mark paid, cancel), invoice stats and exchange rates.
- CRM: accounts, contacts and deals, including converting a deal.
- Collaboration and admin: comments and @mentions, attachments, notifications, templates, saved views, bookmarks, sharing and share links, roles, custom fields and statuses, automations, analytics, audit log, and the recycle bin.
- Search across records, and whoami to confirm who Claude is acting as.
Anything outside that list is out of reach, for example importing data, changing billing or the Settings pages, or the integrations screen. Claude also cannot see anything you cannot: records outside your access simply do not appear.
Treat Read & write like handing over your keyboard. With write access, Claude can create, change and delete records, including emptying the recycle bin if your role allows it. Start with Read-only, and only move to Read & write for work you are happy to review afterwards.
How to create a personal access token
- Click your name or avatar and open Profile.
- Find the MCP card and click New Token. The New Access Token window opens.
- Enter a Name that tells you where it will be used, for example Claude Code on my laptop.
- Choose Access:
- Read-only (the default and the recommended choice): Claude can view but never change anything. This is enforced on the server, so every write is rejected whatever your role is.
- Read & write: Claude can act with your full permissions.
- Optionally set an Expires date. It must be in the future. Leave it blank for a token that does not expire until you revoke it.
- Click Create Token. In the Token Created window, copy the token, which starts with
pat_.
The token is shown once. Autovella stores only a protected form of it, so it cannot be shown again. If you lose it, revoke it and create a new one. Never paste a token into a chat, ticket or shared document.
Accounts that are set up as API-key only cannot create personal access tokens. If you see an error about this, ask your administrator to use an API key instead (see Using the Autovella API).
How to connect Claude Code and other MCP clients
Under the token list, the MCP card shows ready-made commands with your organization's server address filled in, and a Copy button for each. The address has the form https://mcp.your-domain/mcp.
- Copy your token (step above) and open a terminal.
- For Claude Code, run the command from the MCP card, replacing
pat_...with your token: The command looks like this:claude mcp add --transport http autovella https://mcp.your-domain/mcp --header "Authorization: Bearer pat_..." - For Codex CLI, the card shows a matching command that passes the token in an environment variable named
AUTOVELLA_MCP_TOKEN. - For any other MCP client, add an HTTP MCP server at the same address with the header
Authorization: Bearer pat_..., following that client's own instructions. - Restart the client and check its server list. In Claude Code, type
/mcpand confirm autovella shows as connected.
Then try a prompt such as "List my open tasks", "Create a task for project X" or "Log 3 hours on project Y today". If Claude is unsure who it is acting as, ask it to run whoami. With a read-only token, requests to create or change something return a message saying the token is read-only.
Put Claude to work on your projects
Start a free trial, create a read-only token and ask Claude about your open tasks.
How to connect claude.ai or ChatGPT with OAuth (no token to copy)
Web connectors use a sign-in flow instead of a copied token.
- In claude.ai or ChatGPT, open the connector settings and add a custom connector.
- Enter the server address shown on your Profile page's MCP card (
https://mcp.your-domain/mcp). - You are sent to an Autovella Connect to Autovella page that names the app asking for access and where it will send you back. Check that you recognise it.
- Enter your Autovella Email or username and Password.
- Choose Access: Read-only (view but never change anything) or Read & write (act with my full permissions), then click Continue.
The connector then appears in your token list on the Profile page, named after the app with (OAuth), and it expires automatically after a set period (90 days by default). You can revoke it from there like any other token, and when it expires you simply reconnect.
How to review, revoke and secure your access
The token list on your Profile page shows each token's name, an Read-only or Read & write badge, the last characters of the token, when it was created, when it was Last used (or Never used) and any expiry. Expired tokens are labelled Expired.
- Revoke: click the trash icon on a token and confirm Revoke Token. The assistant loses access immediately.
- One token per tool: name tokens by device or app so you can revoke just one.
- Prefer an expiry date for tokens you only need for a project or a trial.
- Revoke what you do not recognise, and anything with Never used that you no longer need.
- Password resets invalidate existing tokens, so you may need to create a new token afterwards.
Creating and authorizing tokens is recorded in your organization's audit trail, so administrators can see when access was granted. See Recycle bin and audit log.
Troubleshooting
- "This access token is read-only": create a Read & write token or reconnect and choose Read & write.
- Permission denied: you do not have that permission in Autovella. Ask an administrator to adjust your role rather than creating a different token.
- Connection fails: confirm the address ends with
/mcp, the token was copied in full and has not expired or been revoked, and that you restarted the client.
Frequently asked questions
No. A token or OAuth connection acts as you, with your role, permissions and organization limits. Claude cannot see or change anything you could not see or change in the web app.
Read-only lets Claude view data but is blocked on the server from changing anything. Read & write lets Claude create, update and delete records with your full permissions. Read-only is the default and the safer starting point.
No. The full token is shown only once when you create it. Revoke the old one in the MCP card on your Profile page and create a new token.
Add a custom connector pointing at the server address shown in the MCP card on your Profile page, sign in with your Autovella login, and choose Read-only or Read & write on the approval screen. No token copy-paste is needed.
Open Profile, find the token in the MCP card and click the trash icon, then confirm Revoke Token. Access ends immediately, and you can create a new token later.
The MCP card is hidden for the Customer role. If you are an internal user and still cannot see it, contact your administrator to confirm your role.