Oracle NetSuite

Explore authentication, permissions and available actionsExact inputs, sign-in scopes, access limits and approval rules.

• Status: Needs setup. It works once you've done the steps under Before you connect.
• Connects through: Oracle NetSuite's own MCP server, at your account's address (https://<account-id>.suitetalk.api.netsuite.com/services/mcp/v1/all).
• Category: Finance & accounting

What hires can doCopy Anchor Link

Financials, orders, inventory and records in NetSuite.

Oracle NetSuite's MCP server decides which tools there are. When you test the connection, Roster asks it and lists every tool with whether it only reads or changes something. You choose which ones hires may use, and the list you save is the list they get, until you test again.

Before you connectCopy Anchor Link

1. Use your account's address: https://<account-id>.suitetalk.api.netsuite.com/services/mcp/v1/all.
2. Create an OAuth app in NetSuite (Setup → Integration → Manage Integrations → New, with OAuth 2.0 authorization code grant).
3. Add the callback address shown on the connection as its redirect URI.
4. Paste the app's client ID and secret into the connection, then press Connect.

Connect itCopy Anchor Link

1. Open Integrations → Tools → Add a tool, search for Oracle NetSuite and choose it.
2. Server address: your own, like https://<account-id>.suitetalk.api.netsuite.com/services/mcp/v1/all.
3. Paste your OAuth app's client ID and secret (from the steps above), click Connect, then Connect with Oracle NetSuite, and approve Roster.
4. Click Test connection. Untick any tool no hire should use, and click Save tools.

More in MCP servers.

Choose what each hire may doCopy Anchor Link

Connecting Oracle NetSuite gives it to no one. On a hire's Tools tab, click Give access on the connection:

• Read only: only the tools the server marks as read-only, or that you ticked as Changes nothing.
• Read and write: every tool you saved on the connection.
• Tools: if you like, only some of them for this hire.

See Adding a tool.

When it asks firstCopy Anchor Link

On the connection, Ask before using starts at Tools that change things: every call to a tool that changes something waits for a person's approval in chat, and Roster makes exactly that call, once, when it's approved. Tools that only read never ask. Once you trust your hires with Oracle NetSuite, you can change it to Only tools a hire is set to ask about.

To change it for one hire, or for single tools, use When it asks first on the hire's Tools tab (more).

Personal dataCopy Anchor Link

Oracle NetSuite holds personal data about your customers and suppliers, and what they owe. Hires see what Oracle NetSuite's tools return, shortened when it's very long, with the connection's own token or password taken out. Roster doesn't take anything else out. Give access only to hires whose work needs it, choose Read only where that's enough, and untick tools that return more than the work needs. Everything a hire does here is on its timecard.

Good to knowCopy Anchor Link

• Hires use Oracle NetSuite while they work on something; changes in Oracle NetSuite don't wake them. To have a hire check it regularly, give it a responsibility on a schedule.
• Which tools hires get is up to Oracle NetSuite's server. When it adds or changes tools, click Test again on the connection; until then hires keep the tools you saved.
• If the sign-in expires or is revoked, hires are told plainly; click Reconnect on the connection.

Learn moreCopy Anchor Link

• Oracle NetSuite's own docs
• netsuite.com
• Where Oracle NetSuite gives its MCP server's address
• MCP servers
• Approvals
• Every tool

Tools and permissions reference

This reference is built from the same definitions Roster uses to connect Oracle NetSuite and give hires access. It updates with each release.

Authentication and requested permissions

The account or app you connect sets the outer limit. Each hire's access can narrow it further. Connecting a tool gives it to no hire until you give access on that hire's Tools tab.

MCP OAuth

The server supplies its authorization details and requested scopes when you connect. Review its consent screen.

No fixed permission list is declared for this connection. Review the sign-in consent screen, the account's roles, and the service's own documentation before connecting.

Connection fields

Oracle NetSuite connection fields

Field	What to provide
Server address url Required	Your own server's address: the setup steps say where to find it.
OAuth app client ID clientId Required	From the OAuth app you created for Roster at the tool.
OAuth app client secret clientSecret Optional · sealed secret	If the app has one.
Ask before using askFirst Optional	With “Tools that change things”, a hire's call to any tool here that changes something waits for a person's approval in chat, and runs exactly as asked once approved. New connections start there; choose the other option once you trust the hires with this connection. Each hire's Tools tab can also ask for single tools. Choices: Only tools a hire is set to ask about (never); Tools that change things (writes). Starts with: writes.

Per-hire limits

Read-only hires receive only actions that read. Read-and-write access also allows actions that change things, where the connection itself permits them. An empty resource allowlist usually means everything the connected account can reach; each field below explains its meaning.

Oracle NetSuite per-hire limits

Field	What to provide
Tools tools Optional	Leave empty for every tool on this connection.

Actions

Actions come from the MCP server you connect, so there is no fixed action list to promise here.

Use Test connection to inspect the exact names, descriptions and read/write classifications; select the actions and Save tools. Retest when the service changes. A server's read-only labels are supplied by that server: review them before granting access.

Watches and incoming events

• No built-in watch is declared. Give a hire a scheduled responsibility if it should check this service regularly.
• No incoming webhook handler is declared for this integration.

Limits and troubleshooting

• Permission errors: check both the connected account's rights and the hire's resource and read/write limits.
• Expired or revoked access: reconnect or replace the key on the connection.
• Rate limits and unavailable services can interrupt work. The hire's timecard records the outcome.
• The action schema describes accepted inputs. It does not grant additional access or bypass approvals.

Service documentation · Integration source reference