AssetBolt exposes its inventory through the Model Context Protocol (MCP), so an AI assistant (Claude, a custom agent, or any MCP-capable client) can look up and manage your assets in conversation instead of through the UI.
MCP is available on the Pro and Scale plans. Connections from organizations on other plans are rejected before any tool runs.
MCP connections use OAuth only. Add the MCP endpoint in your assistant and choose Connect, which opens AssetBolt for you to sign in. Once connected, the assistant acts as you, with your role's permissions.
API keys are no longer accepted on the MCP endpoint. If an assistant is still configured with an API key, it gets an error telling it to reconnect over OAuth instead. Existing API keys keep working for the ordinary AssetBolt API, they just can't be used for MCP anymore.
The assistant only gets tools it's actually allowed to use. What's advertised depends on:
Your role's permissions. A Technician sees device and inventory tools but not member or API-key management; an Auditor sees read-only tools only, because their role has no write permissions to grant.
Your plan. Tools that need a feature your plan doesn't include (or a permission your role doesn't hold) are left off the list rather than shown and then rejected.
Authorization is still checked again on every call. The visibility rules just keep the assistant from offering something it can't do.
Roughly two dozen tools cover the day-to-day inventory workflow:
Finding things: search_assets (devices, accessories, consumables, components, licenses, digital assets), list_reference_data (categories, device models, manufacturers, vendors), list_people, list_teams, list_locations.
Devices and other assets: checkout_asset and checkin_asset (devices, and accessories tracked by quantity), create_asset, update_asset, update_asset_status.
Asset requests: create_asset_request, list_asset_requests, act_on_asset_request (approve, deny, or fulfill).
Licenses: assign_license and unassign_license. AssetBolt tracks license seats as a count, not a per-person record, so the person named in these calls is recorded on the audit trail only, not as a seat owner.
Stock and components: adjust_consumable_stock (receive or consume, written to the stock-movement ledger), install_component and remove_component.
People: get_person gives a full custody view of one person, everything they hold, so you can check before offboarding them that nothing is left in their name. It covers devices, accessory assignments, digital assets, teams, and open asset requests; license seats aren't included, since AssetBolt has no per-person seat record to show.
Audits and reporting: record_asset_audit (the same physical-check record described in Auditing assets), plus license_compliance, low_stock_report, inventory_summary, and audit_history.
Every write the assistant makes goes through the same domain logic and validation as the app itself, and is recorded in your audit log against the user who made the connection, so it's clearly distinguishable from a change made directly in the UI.
Tools are also marked as destructive or not, and idempotent or not, so a well-behaved client knows which calls need extra confirmation before running. Assistants are instructed to confirm the exact record and details with you before any write, but you should still only connect an assistant you trust: it acts with your full permissions.
MCP calls are rate-limited per organization per minute, scaled to your plan tier, across every connection your organization has. If a connection is making heavy use of the catalog, an occasional rate-limit response is a sign to slow down or page through results with take/offset, not a sign of an outage.
