> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/netsuite.md). # NetSuite Connect your company's NetSuite so agents can work with ERP records through Cakewalk's gateway. NetSuite's AI Connector Service is an official, free MCP server built into every account; a few features Connect your company's NetSuite to Cakewalk's MCP Gateway. Every agent tool call against NetSuite passes through the gateway and is evaluated against your Policies. NetSuite's MCP server is the **NetSuite AI Connector Service**, an official Oracle service included with NetSuite at no extra charge. The tools come from the free **MCP Standard Tools** SuiteApp, which covers creating, retrieving and updating NetSuite records. {% hint style="warning" %} NetSuite refuses AI Connector Service calls from the Administrator role and from roles with full permissions, as a security measure. Every person who connects needs a non-administrator role with the specific permissions below, and must pick that role when signing in. {% endhint %} ## Setup Flow: Per-Account Endpoint, No Client Secret Each NetSuite account gets its own MCP endpoint on the account's SuiteTalk domain. Authentication is OAuth 2.0 Authorization Code Grant with PKCE as a public client: there is no client secret. NetSuite tracks the connected client as an integration record, which is often created automatically on the first connection; if it is not, an Administrator creates it manually (Step 4). ## Requirements * A NetSuite Administrator, to enable features, install the SuiteApp and manage roles and integration records. * A Cakewalk Admin, to add the Connection. * Your NetSuite **account ID**, found at **Setup > Company > Company Information**. It becomes part of the MCP endpoint URL. * For each employee who connects: a non-administrator role with the permissions from Step 3. ## Step 1: Enable the Features in NetSuite A NetSuite Administrator goes to **Setup > Company > Enable Features**, opens the **SuiteCloud** subtab and enables: * **Server SuiteScript** * **OAuth 2.0** * **REST Web Services** (required by the MCP Standard Tools SuiteApp) ## Step 2: Install the MCP Standard Tools SuiteApp Install the **MCP Standard Tools** SuiteApp from the SuiteApp Marketplace. It is free and provides the standard tool set the agents will use. ## Step 3: Prepare a Role for MCP Access The Administrator role cannot use the AI Connector Service, so every user connects with a non-administrator role. On **Setup > Users/Roles > Manage Roles**, give that role, under **Permissions > Setup**: * **MCP Server Connection** * **Log in using OAuth 2.0 Access Tokens** (not the similarly named "Log in using Access Tokens") * **REST Web Services** Then add the record-level permissions for the NetSuite data agents should reach, for example sales orders or invoices. NetSuite enforces this role's permissions on every tool call, so the role is also your narrowest control over what agents can touch. ## Step 4: Add the Connection in Cakewalk Add NetSuite as a Connection with the MCP server URL, leaving client ID and client secret empty. The URL for the standard tools is: ``` https://.suitetalk.api.netsuite.com/services/mcp/v1/suiteapp/com.netsuite.mcpstandardtools ``` Replace `` with your account ID from **Setup > Company > Company Information**. See [Add a Custom Connection](/docs/ai-agent-access/how-to-guides/connections/add-a-custom-connection.md) for the flow. NetSuite also offers an endpoint that exposes every MCP tool in the account, including custom SuiteScript tools: `https://.suitetalk.api.netsuite.com/services/mcp/v1/all`. Start with the standard tools endpoint unless you have built custom tools you want agents to use. {% hint style="info" %} NetSuite represents the connected client as an integration record under **Setup > Integration > Manage Integrations**, often created automatically on the first connection. If the first sign-in fails, or the record is missing required fields, an Administrator creates one manually with **Public Client** checked, **Authorization Code Grant** checked, the **NetSuite AI Connector Service** scope enabled and the **Redirect URI** field populated with Cakewalk's callback, then recreates the connection. {% endhint %} ## Step 5: Employees Connect From an agent platform connected to Cakewalk, the employee connects NetSuite and signs in with their own NetSuite credentials. During sign-in, NetSuite asks which role to use: pick the non-administrator role from Step 3. Each call then runs with that role's permissions. ## What Agents Can Reach * The MCP Standard Tools SuiteApp's tool set for creating, retrieving and updating NetSuite records, bounded by the signed-in role's permissions. * Via the `/all` endpoint, additionally any custom MCP tools built with SuiteScript in your account. Every AI Connector Service call is also logged on the NetSuite side: the integration record's **Execution Log** tab has an **AI Connector Service (MCP)** subtab with the calls associated with that record. {% hint style="warning" %} Oracle states the AI Connector Service has not been assessed for HIPAA compliance and must not be used to store, process or transmit electronic protected health information. {% endhint %} ## Verifying It Works The NetSuite Connection card flips to Active on All Connections. From an agent platform connected to Cakewalk, ask the agent for a record your role can read, for example a recent sales order. If NetSuite returns it, the Connection is live. ## Troubleshooting * **Sign-in is refused outright.** You are signing in with the Administrator role or another full-permission role. NetSuite blocks these for the AI Connector Service; switch to the role from Step 3. * **Sign-in succeeds but tool calls fail with a permission error.** The role is missing **MCP Server Connection**, **Log in using OAuth 2.0 Access Tokens** or **REST Web Services**, or lacks the record-level permission for the data requested. * **The OAuth flow fails before the NetSuite login appears.** Check the integration record under **Setup > Integration > Manage Integrations**: it needs Public Client, Authorization Code Grant, the AI Connector Service scope and a populated Redirect URI. Recreate it if fields are missing, then reconnect. * **The endpoint returns not found.** The account ID in the URL is wrong, or the MCP Standard Tools SuiteApp is not installed (for the suiteapp endpoint), or a required feature from Step 1 is disabled. ## Learn More * [Connect to the NetSuite AI Connector Service](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_0714082142.html) from Oracle. * [Required Features and Permissions](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_0714080625.html) from Oracle. * [NetSuite AI Connector Service FAQ](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_4160616848.html) from Oracle. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/netsuite.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.