Most ERP vendors are adding a chat box, and a growing number now also expose an MCP server. Nama’s difference is what the AI is allowed to do once it connects: it made the system itself addressable by tools that can act, inside your own permission model. Nama ERP ships a built-in ERP MCP server, so Claude Desktop, Claude Code or any other client that speaks the Model Context Protocol can connect to your live system and work in it — under your users, your permissions and your validation rules.
It is not a demonstration, and it is not on a roadmap. The MCP server is deployed and running at customer sites today.
What that actually means
MCP is the open standard AI assistants use to reach systems they were not built
for. Once the AI module is installed, Nama mounts a server over Streamable HTTP
at /basic-services/mcp, and any MCP client can list what it is allowed to do
and start doing it: searching records, reading documents, running reports,
importing new ones.
The important word is allowed. The client does not get a database connection. It gets exactly the tools an administrator committed on the AI Tool Definition screen — query tools, report tools, entity-flow tools and ready-made system tools — and every one of them runs through the same service gates the screens use. Record-level security applies. Dimensions apply. Validation applies. If a record is imported, its journal entries and inventory transactions post exactly as they would have if somebody had typed it in.
Authentication that maps to a real person
Every request is authenticated with an API Credentials record — the same credentials used with the REST API — and that record names a Login As User. Everything the AI client does, it does as that user. The credential carries a validity window and can be disabled outright.
That single design decision is what makes the feature safe enough to switch on. There is no second permission system for the AI to keep in step with the real one, which is where most governed-AI projects quietly fail. There is one permission system, and the AI is inside it.
The documentation is blunt about the consequence, and so are we: a client connected with these credentials can do everything the mapped user can do. Give it a user with measured permissions, not an administrator.
The tools an external client gets
Beyond whatever you define yourself, one button adds six record tools that make a general-purpose AI client useful against a system it has never seen:
- Resolve entity type — send
فاتورة مبيعاتorsales invoice, get back the internal entity names with their Arabic and English titles. - Find records — a paged, filtered search that goes through the standard list gate, so list security and dimension filtering still apply.
- Get record — read one record as JSON, in the same shape used for import.
- Get enum values — the allowed constants of a field, with both titles.
- Get import schema — every field, what is required, what each reference points at, and how the detail lines nest.
- Import record — write one or many, as a draft for review or committed.
A client that knows none of your entity names can therefore find its way from “create a sales invoice for this customer” to a posted document, and read it back to check its own work.
The question to ask your shortlist
More ERPs now ship an MCP server, so the question is no longer whether an AI client can connect — it is what it may do once it has. Ask each vendor two things. Can the assistant act — create and post records, not only read them? And does it act inside the system’s own permission model, as a real user, or through a second set of rules somebody has to keep in step with the first? Many MCP servers are read-only, or answer from a permission layer bolted on beside the ERP. Nama’s writes, it runs inside the one permission system the screens already use, and it is deployed at customers today.
We put those questions to the systems most often on that shortlist — see how Nama compares with Odoo, NetSuite, SAP Business One and Dynamics 365 Business Central.
Nothing here requires you to adopt AI at all. The module is licensed separately, and the server is not mounted unless you install it. But if your organisation is going to be using AI tools in two years, the question is not whether your ERP has a chat box — it is whether it will be in the loop or worked around.
Good question — already answered
What is MCP, in one sentence?
The Model Context Protocol is the open standard AI assistants use to connect to an external system, read its data and act on it — the same way a driver lets one program talk to a device it was not written for.
Does the AI client get direct access to our database?
No. It gets the tools an administrator committed on the AI Tool Definition screen, and nothing else. Every call goes through the system's standard service gates, so record-level security, dimensions and validation rules apply exactly as they do on screen.
Whose permissions does it run with?
The API Credentials record names a Login As User, and every tool the client calls executes as that user. The practical advice in the documentation is to dedicate a user with carefully measured permissions rather than pointing it at an administrator account.
Is this in production, or on a roadmap?
In production. The MCP server is deployed and working at customer sites.
What do we need before we can connect?
The AI module installed and licensed, a committed API Credentials record, and at least one committed tool definition. Without the module the server is not mounted at all.
