Skip to main content

​
Agency AI Support Access

Agency MCP keys let a support assistant read installed CRM sub-accounts under one agency. Create and revoke these credentials in Admin → Locations → Agency AI Integration (MCP). Treat them as admin credentials and never paste them into Slack, email, or a tracked configuration file.

​
Create a support key

  1. Select the agency and click Create key.
  2. Name the assistant, such as “Claude Tag support”.
  3. Leave Allow full credit reports off. Standard read access includes credit summaries, underwriting results, funding plans, and support diagnostics.
  4. Copy the key once into the assistant’s secure configuration.
Full stored report JSON and PDF downloads require the separate credit_reports permission alongside read. Enable that permission only for an assistant trusted with applicant identity and bureau data. Keep it off for Claude Tag’s workspace-wide support connection.

​
Confirm the location before reading records

Call resolve_location with the Operator’s linked Slack channel or exact identity. A successful match returns the CRM location ID, stored location name, and whether it matched the channel, user ID, or email. Confirm the name with the Operator before looking up Applicants. A missing name is returned as null; unmatched or ambiguous results need clarification before proceeding.

​
Change access and review activity

Keys with only read cannot access raw reports. To change permissions, create a replacement key with the intended setting, update the assistant, then revoke the old key. Existing OAuth connections need fresh consent to add report access; refreshing a token preserves its permissions. Recent agent activity records the operation and location. New MCP audit arguments mask emails, search text, and other personal fields while preserving record IDs for troubleshooting. Existing audit history is unchanged.

​
Staff operations reports

Super Admins signed in through OAuth can use get_ops_timeseries, get_underwriting_decisions, and get_partner_performance for internal operations reports. API keys cannot use these tools. A failed staff identity check denies the request and records the failed attempt in agent activity. Partner performance reads every partner page for each scanned location, including pages with no matching partners. Reports scan at most 40 locations; locationsTotalIsExact says whether locationsTotal is the complete unique Location population. Installation enumeration reads at most 501 records and uses the first 500; if an overflow record exists, locationsTotalIsExact: false means the total is a lower bound. truncated: true means additional locations were excluded or population coverage is uncertain. Pass locationId to read one location’s full roster. That filtered report’s activity is recorded under the location it reads. If a partner page cannot be read, the tool returns an error instead of reporting a complete roster. Partner pages use five raw records per query to bound nested commission, referral, and contact-override reads. This page size does not cap the roster; the report continues until the backend marks the final page complete. Partner rows include commissionIsExact for the commission event count, total and pending amounts, and last commission date. A false value means the commission scan reached its 500-record cap or the backend has not yet supplied coverage metadata; treat those figures as incomplete even when the partner roster itself is complete. Underwriting breakdowns include an unknown row when stored decisions could not be classified, so the rows account for the reported total.