NetSuite
Connect your company's NetSuite so agents can work with ERP records through Cakewalk's gateway. NetSuite's AI Connector Service is an official, free MCP server built into every account; a few features
Connect your company's NetSuite to Cakewalk's MCP Gateway. Every agent tool call against NetSuite passes through the gateway and is evaluated against your Policies.
NetSuite's MCP server is the NetSuite AI Connector Service, an official Oracle service included with NetSuite at no extra charge. The tools come from the free MCP Standard Tools SuiteApp, which covers creating, retrieving and updating NetSuite records.
NetSuite refuses AI Connector Service calls from the Administrator role and from roles with full permissions, as a security measure. Every person who connects needs a non-administrator role with the specific permissions below, and must pick that role when signing in.
Setup Flow: Per-Account Endpoint, No Client Secret
Each NetSuite account gets its own MCP endpoint on the account's SuiteTalk domain. Authentication is OAuth 2.0 Authorization Code Grant with PKCE as a public client: there is no client secret. NetSuite tracks the connected client as an integration record, which is often created automatically on the first connection; if it is not, an Administrator creates it manually (Step 4).
Requirements
A NetSuite Administrator, to enable features, install the SuiteApp and manage roles and integration records.
A Cakewalk Admin, to add the Connection.
Your NetSuite account ID, found at Setup > Company > Company Information. It becomes part of the MCP endpoint URL.
For each employee who connects: a non-administrator role with the permissions from Step 3.
Step 1: Enable the Features in NetSuite
A NetSuite Administrator goes to Setup > Company > Enable Features, opens the SuiteCloud subtab and enables:
Server SuiteScript
OAuth 2.0
REST Web Services (required by the MCP Standard Tools SuiteApp)
Step 2: Install the MCP Standard Tools SuiteApp
Install the MCP Standard Tools SuiteApp from the SuiteApp Marketplace. It is free and provides the standard tool set the agents will use.
Step 3: Prepare a Role for MCP Access
The Administrator role cannot use the AI Connector Service, so every user connects with a non-administrator role. On Setup > Users/Roles > Manage Roles, give that role, under Permissions > Setup:
MCP Server Connection
Log in using OAuth 2.0 Access Tokens (not the similarly named "Log in using Access Tokens")
REST Web Services
Then add the record-level permissions for the NetSuite data agents should reach, for example sales orders or invoices. NetSuite enforces this role's permissions on every tool call, so the role is also your narrowest control over what agents can touch.
Step 4: Add the Connection in Cakewalk
Add NetSuite as a Connection with the MCP server URL, leaving client ID and client secret empty. The URL for the standard tools is:
Replace <accountid> with your account ID from Setup > Company > Company Information. See Add a Custom Connection for the flow.
NetSuite also offers an endpoint that exposes every MCP tool in the account, including custom SuiteScript tools: https://<accountid>.suitetalk.api.netsuite.com/services/mcp/v1/all. Start with the standard tools endpoint unless you have built custom tools you want agents to use.
Step 5: Employees Connect
From an agent platform connected to Cakewalk, the employee connects NetSuite and signs in with their own NetSuite credentials. During sign-in, NetSuite asks which role to use: pick the non-administrator role from Step 3. Each call then runs with that role's permissions.
What Agents Can Reach
The MCP Standard Tools SuiteApp's tool set for creating, retrieving and updating NetSuite records, bounded by the signed-in role's permissions.
Via the
/allendpoint, additionally any custom MCP tools built with SuiteScript in your account.
Every AI Connector Service call is also logged on the NetSuite side: the integration record's Execution Log tab has an AI Connector Service (MCP) subtab with the calls associated with that record.
Oracle states the AI Connector Service has not been assessed for HIPAA compliance and must not be used to store, process or transmit electronic protected health information.
Verifying It Works
The NetSuite Connection card flips to Active on All Connections. From an agent platform connected to Cakewalk, ask the agent for a record your role can read, for example a recent sales order. If NetSuite returns it, the Connection is live.
Troubleshooting
Sign-in is refused outright. You are signing in with the Administrator role or another full-permission role. NetSuite blocks these for the AI Connector Service; switch to the role from Step 3.
Sign-in succeeds but tool calls fail with a permission error. The role is missing MCP Server Connection, Log in using OAuth 2.0 Access Tokens or REST Web Services, or lacks the record-level permission for the data requested.
The OAuth flow fails before the NetSuite login appears. Check the integration record under Setup > Integration > Manage Integrations: it needs Public Client, Authorization Code Grant, the AI Connector Service scope and a populated Redirect URI. Recreate it if fields are missing, then reconnect.
The endpoint returns not found. The account ID in the URL is wrong, or the MCP Standard Tools SuiteApp is not installed (for the suiteapp endpoint), or a required feature from Step 1 is disabled.
Learn More
Connect to the NetSuite AI Connector Service from Oracle.
Required Features and Permissions from Oracle.
NetSuite AI Connector Service FAQ from Oracle.
Last updated
Was this helpful?