Skip to content

How Elaichi connects to AI clients

An AI client is an app that talks to a model and can call tools, such as Claude, ChatGPT, Cursor or Microsoft Copilot. Elaichi works with any client that supports remote MCP servers (MCP is the Model Context Protocol). Each client is set up in its own way, but what happens behind it is the same for all of them.

Where to find the endpoint: in the Elaichi web app, choose Connect in the sidebar, then copy the endpoint shown in Connect your AI client.

Connect one thing, not many

Your AI client makes a single connection, and that connection is to Elaichi. You connect your apps (Slack, Jira, HubSpot) inside Elaichi, not inside the client.

Your AI client  ──one connection──►  Elaichi  ──►  Slack
                                              ──►  Jira
                                              ──►  HubSpot

In words: the client talks only to Elaichi, and Elaichi talks to each connected app on the client's behalf.

Because every call goes through Elaichi, four things stay true:

  • Access follows your role. Toolboxes, teams and per-member restrictions all still apply.
  • Restrictions are enforced. A tool your organization blocked is never offered to the client and never runs.
  • Everything is audited. Tool calls appear in the audit log like any other action.
  • Revoking is one action. Disconnect an app in Elaichi and it disappears from every client.

If you connect apps directly in a client instead, you lose all four.

Elaichi has one endpoint for everyone: not one per toolbox, per app or per organization. The address is the same text for every person. The OAuth grant you approve when you connect decides which organization the client reaches and whose access it runs as. The address does not.

Approve what the client can do

When you connect a client, Elaichi shows a consent screen. Read it before you approve. Over MCP, Elaichi cannot ask you to confirm each write, because the model on the other end could claim its own approval. So you approve ahead of time, and the scopes you grant are the standing approval.

The consent screen is one page with three parts:

  1. Organization. Pick the one organization this connection reaches, next to your account. To reach another organization, connect the client a second time.
  2. Scopes. One checkbox for each scope the client asked for (table below).
  3. Toolboxes. Shown under Use your connected apps while it is ticked. Everything I can use covers your own toolboxes and the system toolbox of every connected app, including ones added later. Only the ones I pick lets you pick up to 50 toolboxes, and the client reaches nothing else.
Scope on the consent screen Code What it allows
See your organization mcp:read Everything you can already see in Elaichi: people, teams, tools, connections, settings and admin records such as the audit log. Never secret values.
Make changes mcp:write Create and change teams, roles, toolboxes, templates, connections and organization settings. Invite new members. Share toolboxes, templates and connections with other people.
Delete things mcp:destructive Permanently delete teams, roles, toolboxes, templates and connections, remove people, and take away access. It covers Elaichi only, not your connected apps. It cannot be undone.
Use your connected apps mcp:tools Run tools from the toolboxes you choose on this screen. That includes tools that delete in those apps.

Every scope the client asks for starts ticked, except Delete things, which always needs a deliberate click. A client that asks for no scope gets See your organization only. Ticking Make changes or Delete things turns See your organization on and locks it.

For most people, See your organization and Use your connected apps are enough. Untick Make changes unless you want the client to reshape your organization.

See exactly what each one includes opens the full list behind every scope. Read it for See your organization at least once. It covers more than the name suggests, including SSO connections, directory group mappings, verified domains, pending invitations and API token metadata (never token values).

Info

A scope cannot be added to an existing connection. To add a scope later, connect the client again and tick it. The client must ask for that scope again for the screen to offer it.

What the client sees

Your access, not the organization's. The endpoint is scoped to your account. The client reaches the toolboxes and connections you own or that were shared with you, and nothing else. Two people who connect to the same endpoint do not see the same tools.

Connected tools are found by searching, not by browsing. Elaichi never lists connected tools one by one, however few you have. It offers these tools instead:

Tool What it does
search_tools Finds a connected tool by name.
read_tool Runs a connected tool that only reads, such as listing channels or getting a record. It is marked read-only, so most clients run it without asking you first. Elaichi refuses anything through it that would change data.
execute_tool Runs any connected tool, including ones that create, change, send or delete. Clients ask you to approve each call.
get_call_result Waits for a connected tool call that is taking a long time, and returns its result. A call still running after 45 seconds, whether it was run with read_tool, execute_tool or elaichi__toolbox__execute, is answered early with a call_id, so your client does not give up on it.
run_code Runs a short program that calls several connected tools in one step.
show_card Draws an interactive card, such as an account picker or a refusal. Offered only to clients that support MCP Apps.

Elaichi's own catalog operations are still listed one by one. This short list stays the same size however many apps you connect, which helps a model choose well.

search_tools ranks results by matching words, not by meaning. Short, concrete words such as "create deal" or "list issues" work well. A full sentence ranks poorly.

Set up your client

Each page below has the steps for one client. A client that is not listed works too, if it can add a remote MCP server by URL, supports OAuth dynamic client registration and can open a browser to sign in.

Ready-made config files for these clients, and for Claude Code, Codex and Windsurf, are in the elaichi-mcp repository on GitHub.